stitch-vue-element-components

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime path fetches Stitch screen HTML from htmlCode.downloadUrl (public/outsider-authored web content) via bash scripts/fetch-stitch.sh "<htmlCode.downloadUrl>" ..., and the downloaded HTML becomes readable text that the agent will parse/map into Vue/LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly downloads arbitrary Stitch screen HTML at runtime using scripts/fetch-stitch.sh which runs curl -L on the provided htmlCode.downloadUrl (e.g. "<htmlCode.downloadUrl>"), and that fetched HTML is a required input that directly controls the agent's conversion prompts/outputs.