stitch-download

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to insert and emit raw download URLs (signed URLs) directly into shell commands and generated files (e.g., bash scripts using "{htmlCode.downloadUrl}" and "{screenshot.downloadUrl}"), which can contain secrets/tokens and require the LLM to output them verbatim — creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime path calls mcp__stitch__get_screen and then downloads the returned htmlCode.downloadUrl (HTML source) and screenshot.downloadUrl (PNG) into .stitch/designs/*; the HTML source is outsider-authored content from Stitch projects/screen definitions that the operating user did not author, and it becomes LLM-readable prose when the agent ingests/handles the downloaded HTML during processing.