The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes a local bash script (scripts/fetch-stitch.sh) to handle network redirects and TLS when fetching design assets. It also utilizes npm commands for dependency management and running the development server.
[EXTERNAL_DOWNLOADS]: Fetches design metadata, HTML, and screenshots from the Stitch service (associated with Google, a trusted vendor). It also downloads standard frontend dependencies from the official npm registry.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface by ingesting design JSON and HTML from external Stitch projects to generate Vue components. Maliciously crafted design metadata could theoretically attempt to influence the code generation process.
Ingestion points: Screen metadata and HTML retrieved via the get_screen MCP tool and downloaded using scripts/fetch-stitch.sh.
Boundary markers: The instructions do not define specific delimiters or warnings for the agent to ignore instructions embedded within the source design HTML.
Capability inventory: File system writes (creating .vue and .js files) and shell command execution (bash, npm).
Sanitization: No specific sanitization or filtering of the ingested design content is described.
[DYNAMIC_EXECUTION]: The skill generates Vue Single File Components (.vue) and data files (mockData.js) at runtime based on the design specification, which are intended to be executed within a Vite development environment.

stitch-ui-vue-element-plus-components