The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a local shell script (scripts/fetch-stitch.sh) using arguments interpolated from external API data (downloadUrl, width, page-slug). This represents a potential surface for command injection if the variables are not correctly sanitized before being passed to the shell.
[EXTERNAL_DOWNLOADS]: Remote HTML and image assets are downloaded from Google Cloud Storage signed URLs provided by the Stitch API. These assets are stored in a local cache directory (.stitch/designs/) for processing.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted HTML source code from an external design platform to generate functional React components. Maliciously crafted HTML could attempt to influence the generated code or agent behavior.
Ingestion points: Untrusted HTML fetched from Stitch API and cached at .stitch/designs/{page-slug}.html.
Boundary markers: None identified; the content is processed directly as source for decomposition.
Capability inventory: The skill has access to file system operations (Read, Write, Edit, Glob) and shell execution (Bash), allowing it to modify application code and configuration.
Sanitization: Instructions specify stripping tags like <html>, <head>, and <script>, but lack programmatic sanitization or strict schema validation for the ingested data.

stitch-react