The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/fetch-stitch.sh script downloads design HTML content from external URLs using Python's urllib.request library. While the URLs are provided dynamically at runtime, the skill instructions provide guidance on scoping this access to Stitch-provided assets.
[COMMAND_EXECUTION]: The SKILL.md instructions direct the agent to execute an external utility script (python3 utilities/skill-builder/scripts/record_skill_feedback.py) to persist usage and performance metrics. This script is located outside the skill's own directory structure.
[PROMPT_INJECTION]: The skill processes untrusted HTML data retrieved from external Stitch URLs, creating an indirect injection surface. * Ingestion point: scripts/fetch-stitch.sh downloads HTML content from design URLs. * Boundary markers: SKILL.md includes explicit instructions for the agent to treat download URLs as untrusted input and limit network scope. * Capability inventory: The skill utilizes Read, Write, and Bash tools to generate and validate code files. * Sanitization: No programmatic sanitization or filtering is performed on the downloaded HTML content prior to structural extraction.

react-components