react-vite-dashboard

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill automates React component generation by processing external screen data from the Stitch platform and local DESIGN.md files. This creates a surface where instructions hidden in design data could potentially influence the agent's code output.
  • Ingestion points: Fetches screen data via Stitch MCP and reads DESIGN.md as described in SKILL.md, Workflow steps 2 and 4.
  • Capability inventory: The skill has access to Bash, Write, and web_fetch tools according to the frontmatter.
  • Boundary markers: No specific delimiters or "ignore instructions" directives are present for handling external design data in the prompt instructions.
  • Sanitization: The skill does not define specific sanitization logic for data retrieved from the Stitch API or the local filesystem before processing it for code generation.
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute packages including @google/design.md and google-labs-code/stitch-skills. These resources are provided by well-known organizations.
  • [COMMAND_EXECUTION]: The instructions guide the agent to perform environment setup and design linting using shell commands via npx.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 12:29 PM