react:components
Pass
Audited by Gen Agent Trust Hub on May 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local Bash script (
scripts/fetch-stitch.sh) to download design assets usingcurl. This is documented as a reliability measure for fetching assets from Google Cloud Storage. - [EXTERNAL_DOWNLOADS]: The skill fetches HTML and image assets from signed URLs provided by the Stitch MCP server. These assets are stored locally in the
.stitch/directory for analysis. - [REMOTE_CODE_EXECUTION]: The skill instructions include running
npm installto set up the environment and enable the@swc/corevalidation tools. This is a standard development workflow for this type of tool. - [PROMPT_INJECTION]: No patterns of instruction overriding, safety bypasses, or system prompt extraction were found in the skill metadata or body.
- [DATA_EXFILTRATION]: No sensitive file access or unauthorized network transmission patterns were identified. Network operations are limited to asset retrieval from intended sources.
Audit Metadata