The Agent Skills Directory

[SAFE]: The skill uses a bash script (scripts/fetch-stitch.sh) to download design assets. The use of curl is documented as a reliability measure for Google Cloud Storage and does not target untrusted domains.
[COMMAND_EXECUTION]: The skill executes npm install, npm run validate, and bash scripts/fetch-stitch.sh. These are standard development tasks for the skill's stated purpose and include explicit gates requiring user permission for potentially disruptive actions like starting a dev server.
[DATA_EXPOSURE]: The skill reads project metadata and local design files to sync components. No evidence was found of exfiltrating sensitive credentials like SSH keys or AWS configs.
[PROMPT_INJECTION]: Instructions include strict gates and 'MANDATORY' steps to ensure the AI follows a specific engineering pipeline, which is a common pattern for high-fidelity code generation and not an attempt to bypass safety filters.

stitch::react-components