The Agent Skills Directory

[SAFE]: The skill provides utility scripts to generate static HTML snapshots, facilitating the review and upload of UI designs to the Stitch platform. The implementation demonstrates a strong security posture with several defensive measures.
[EXTERNAL_DOWNLOADS]: The scripts/snapshot.ts script uses the puppeteer library. When initialized, Puppeteer typically downloads a browser binary (Chromium) to perform rendering. This is a well-known behavior of a standard library used for its intended purpose.
[DATA_EXFILTRATION]: Both scripts/extract_inline_html.ts and scripts/snapshot.ts perform outbound network requests to fetch images and assets for inlining.
The extract_inline_html.ts script includes a dedicated isSafeUrl function that implements SSRF (Server-Side Request Forgery) protection by blocking requests to loopback (127.0.0.1), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and link-local (169.254.0.0/16) IP ranges.
[COMMAND_EXECUTION]: The workflow requires the agent to execute the provided TypeScript scripts using npx tsx. These executions are scoped to the skill's directory and are necessary to process the user's project files into the desired HTML format.
[SAFE]: The scripts/post_process.ts script uses atomic file operations (opening a file descriptor and using fstatSync and ftruncateSync) to eliminate Time-of-Check to Time-of-Use (TOCTOU) race conditions when reading and inlining local assets.
[SAFE]: The scripts/extract_inline_html.ts script uses an escapeRegExp helper to sanitize user-provided patterns before they are incorporated into a regular expression, preventing potential Regular Expression Denial of Service (ReDoS) attacks.

stitch-extract-static-html