react:components

Pass

Audited by Gen Agent Trust Hub on May 30, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a local Bash script (scripts/fetch-stitch.sh) to download design assets using curl. This is documented as a reliability measure for fetching assets from Google Cloud Storage.
  • [EXTERNAL_DOWNLOADS]: The skill fetches HTML and image assets from signed URLs provided by the Stitch MCP server. These assets are stored locally in the .stitch/ directory for analysis.
  • [REMOTE_CODE_EXECUTION]: The skill instructions include running npm install to set up the environment and enable the @swc/core validation tools. This is a standard development workflow for this type of tool.
  • [PROMPT_INJECTION]: No patterns of instruction overriding, safety bypasses, or system prompt extraction were found in the skill metadata or body.
  • [DATA_EXFILTRATION]: No sensitive file access or unauthorized network transmission patterns were identified. Network operations are limited to asset retrieval from intended sources.
Audit Metadata
Risk Level
SAFE
Analyzed
May 30, 2026, 03:59 PM
Security Audit — agent-trust-hub — react:components