stitch::react-components

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires the agent to embed MCP-provided download URLs verbatim into shell commands (e.g., bash scripts/fetch-stitch.sh "[htmlCode.downloadUrl]"), which can contain presigned tokens or secrets and thus forces the LLM to handle/output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). High-risk runtime path: Phase 1 uses Stitch MCP get_screen to obtain signed downloadUrls for design HTML/screenshots, then the workflow downloads the resulting HTML (free-text) via scripts/fetch-stitch.sh ... -o .stitch/designs/{page}.html, which would later be parsed for Tailwind tokens and used to generate code (indirect prompt injection risk from outsider-authored design HTML).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the agent at runtime to fetch external design assets via the signed download URLs (e.g., "[htmlCode.downloadUrl]" and "[screenshot.downloadUrl]=w{width}") using scripts/fetch-stitch.sh, and those fetched HTML files (which include the project's tailwind.config) directly control the token extraction and component-generation behavior.