react-vite-dashboard
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill automates React component generation by processing external screen data from the Stitch platform and local
DESIGN.mdfiles. This creates a surface where instructions hidden in design data could potentially influence the agent's code output. - Ingestion points: Fetches screen data via Stitch MCP and reads
DESIGN.mdas described in SKILL.md, Workflow steps 2 and 4. - Capability inventory: The skill has access to
Bash,Write, andweb_fetchtools according to the frontmatter. - Boundary markers: No specific delimiters or "ignore instructions" directives are present for handling external design data in the prompt instructions.
- Sanitization: The skill does not define specific sanitization logic for data retrieved from the Stitch API or the local filesystem before processing it for code generation.
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute packages including@google/design.mdandgoogle-labs-code/stitch-skills. These resources are provided by well-known organizations. - [COMMAND_EXECUTION]: The instructions guide the agent to perform environment setup and design linting using shell commands via
npx.
Audit Metadata