stitch-ui-vue-layui-components

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow retrieves remote Stitch design HTML via get_screen download URLs and fetches it via shell scripts, but the URLs are provided by the user or chosen interactively during design retrieval rather than monitoring an outsider-authored feed or public inbox.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs downloading content at runtime via a bash script invoking curl using a URL supplied dynamically from an external API (htmlCode.downloadUrl), meeting the operational dependency criteria.