The Agent Skills Directory

[SAFE]: No malicious patterns, hardcoded credentials, or unauthorized persistence mechanisms were identified in the skill files. Behavior is consistent with the stated purpose of a frontend development assistant.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it ingests and processes external HTML content fetched from the Stitch platform. This surface is considered safe as the data source is a trusted service.
Ingestion points: temp/source.html created by scripts/fetch-stitch.sh.
Boundary markers: Not explicitly defined for the HTML parsing step.
Capability inventory: Read, Write, Bash, and web_fetch tools are enabled.
Sanitization: The skill does not provide specific instructions for sanitizing or escaping the downloaded content before processing.
[EXTERNAL_DOWNLOADS]: The skill utilizes a local Bash script to download design assets from Google Cloud Storage. These downloads are performed using curl on URLs provided by the Stitch MCP and are necessary for the design conversion workflow.

stitch-vue-element-components