stitch-vue-element-components
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches design assets from Google Cloud Storage via official Stitch service URLs.- [COMMAND_EXECUTION]: Executes a local bash script (scripts/fetch-stitch.sh) using the Bash tool to download design data. The script takes an external URL as an argument, which presents a potential command injection vector if the input is malicious, though the instructions recommend quoting the URL to mitigate risk.- [PROMPT_INJECTION]: The skill ingests and processes HTML content from external Stitch designs to generate Vue components. This creates an indirect prompt injection surface. Ingestion points: temp/source.html (as described in SKILL.md). Boundary markers: Absent in the instructions for processing the file. Capability inventory: The skill employs Bash, Write, and Read tools. Sanitization: No specific sanitization or validation of the ingested HTML content is defined.
Audit Metadata