react:components

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt instructs the agent to embed and emit design download URLs (e.g., htmlCode.downloadUrl and screenshot.downloadUrl) verbatim inside shell commands—which are often signed URLs or tokens—so the LLM would have to handle/output secret-bearing strings directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow fetches outsider-authored Stitch HTML via get_screen → htmlCode.downloadUrl and then scripts/fetch-stitch.sh uses curl to download that HTML into .stitch/designs/{page}.html, which is readable text originating from an external project and can contain free-form attacker-controlled content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly performs system-level fetches at runtime using the Stitch signed download URLs (the htmlCode.downloadUrl and screenshot.downloadUrl passed to scripts/fetch-stitch.sh, typically GCS signed URLs) and the fetched HTML is parsed (including a localized tailwind.config in the HTML ) to drive how components are generated, so these runtime external URLs directly influence the agent's behavior.