stitch-vue-bootstrap-components
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local bash script
scripts/fetch-stitch.shwhich usescurlto download design assets. This is an intended workflow for reliable data retrieval from the Stitch service. - [EXTERNAL_DOWNLOADS]: The skill fetches design specifications and HTML source code from the Stitch platform (on Google Cloud Storage). These resources originate from a well-known service and are required for the conversion task.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external design HTML and metadata to generate Vue components, creating a surface for potential injection.
- Ingestion points: Design metadata and HTML retrieved via Stitch MCP tools and the
fetch-stitch.shutility script. - Boundary markers: The instructions lack specific delimiters or directions for the agent to treat ingested HTML content as purely data or to ignore embedded instructions.
- Capability inventory: The agent can execute shell commands, perform file system writes to create components, and run npm installation/development commands.
- Sanitization: No explicit logic is provided to sanitize or filter the ingested HTML content before it is used by the AI for code generation.
Audit Metadata