stitch-react-components
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/fetch-stitch.shutility usescurlto download design assets from external URLs. This is the documented mechanism for retrieving Stitch HTML exports and visual references. - [COMMAND_EXECUTION]: The skill employs local scripts for automation:
scripts/fetch-stitch.sh: Executes a shell script to fetch content viacurl.scripts/validate.js: Runs a Node.js script that uses@swc/coreto parse and validate the syntax and structure of generated TypeScript React components.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes external HTML data from Stitch exports. Maliciously crafted content in the design source could attempt to manipulate the agent's output. The skill mitigates this through a mandatory verification protocol and architectural quality gates.
- [SAFE]: The skill includes explicit instructions in the 'Anti-Patterns' section to avoid reading, storing, or committing sensitive data such as Stitch API keys, MCP secrets, or cookies.
Audit Metadata