Skills
skills/full-stack-skills/stitch-skills/stitch-vue-layui-components/Gen Agent Trust Hub

stitch-vue-layui-components

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Downloads design assets from Stitch (Google) servers.
  • Evidence: The script scripts/fetch-stitch.sh uses curl to fetch content from design URLs provided by the Stitch MCP.
  • [COMMAND_EXECUTION]: Runs local shell commands for project management and file operations.
  • Evidence: SKILL.md directs the user to run npm install and execute bash scripts/fetch-stitch.sh to retrieve source files.
  • [PROMPT_INJECTION]: Ingests and parses external HTML to generate source code, which is a potential surface for indirect prompt injection.
  • Ingestion points: temp/source.html downloaded from external URLs.
  • Boundary markers: Not explicitly defined in the conversion instructions.
  • Capability inventory: Shell access (bash), file system access (Write/Read).
  • Sanitization: None specified for the input HTML processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 04:06 PM
Security Audit — agent-trust-hub — stitch-vue-layui-components