The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes a shell script to fetch design assets from Google-hosted URLs provided by the Stitch MCP tool. These downloads are part of the core functionality and target known, trusted service endpoints.
[COMMAND_EXECUTION]: The skill uses Bash for local project setup and execution of internal utility scripts. These operations are standard for development workflows and are clearly documented for the agent.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface when processing external data:
Ingestion points: HTML content is fetched from remote URLs and saved to temp/source.html for parsing (SKILL.md).
Boundary markers: The instructions do not define specific delimiters or warnings to ignore instructions embedded in the source HTML.
Capability inventory: The skill has access to Bash (via scripts/fetch-stitch.sh and npm), Write (for component creation), and Read tools.
Sanitization: No explicit sanitization or filtering of the retrieved HTML content is performed before processing.
Context: The source of data is the integrated Stitch MCP platform, which is a recognized service, mitigating the risk.

stitch-vue-bootstrap-components