stitch-ui-contract-bootstrap
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official documentation and the source code repository for Bootstrap-Vue (e.g., bootstrap-vue.org and github.com/bootstrap-vue). These are well-known resources for the design framework used by the skill.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user-supplied requirements to generate UI design contracts. While this presents an attack surface where a user could provide instructions instead of data, the skill includes explicit workflow contracts and validation checklists (e.g.,
references/validation-checklist.md) to mitigate unauthorized actions and ensure output integrity. - [NO_CODE]: The skill primarily generates text-based design tokens and prompt templates. It does not contain or execute arbitrary scripts, though it provides instructions for the user to install related tools from the same vendor via
npx.
Audit Metadata