stitch-ui-contract-layui
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is primarily composed of design tokens, component contracts, and prompt templates for UI design alignment. No suspicious commands or data handling patterns were identified.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user design requirements to generate prompts for an external system ('Stitch'). This represents a potential indirect prompt injection surface if the user-provided design descriptions contain malicious instructions intended to influence the downstream generation.
- Ingestion points: User requests for design, beautification, or refinement tasks in
SKILL.md. - Boundary markers: The skill uses explicit section headers such as
[Context],[Layout], and[Components]to delimit injected content in its output prompts. - Capability inventory: The skill has no capabilities to execute code, write files, or perform network operations; it only generates text and JSON output.
- Sanitization: No explicit sanitization of user input is performed before interpolation into the output template.
Audit Metadata