stitch-vue-layui-components
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses a bash script to download HTML code and screenshots from Stitch design URLs, typically hosted on Google Cloud Storage domains. This is required for its primary conversion function.
- [COMMAND_EXECUTION]: The agent is instructed to execute local bash scripts and standard Node.js development commands, such as
npm installandnpm run dev, to set up and verify the generated project environment. - [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection because it processes external HTML data fetched from remote URLs.
- Ingestion points:
temp/source.html(downloaded design content). - Boundary markers: No specific delimiters or instructions to ignore embedded content are provided.
- Capability inventory:
Write(file creation),Bash(script and npm execution). - Sanitization: No explicit validation or filtering of the source HTML content is described.
Audit Metadata