stitch-react-native
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a helper script, scripts/fetch-stitch.sh, which invokes curl to download HTML design assets from external URLs provided at runtime.
- [COMMAND_EXECUTION]: The package.json configuration includes scripts that execute local Bash and Node.js files to fetch designs and validate component syntax.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process external, untrusted design data to generate React Native code, which introduces a potential attack surface. Ingestion points: Design files are fetched via scripts/fetch-stitch.sh and processed based on SKILL.md instructions. Boundary markers: The skill explicitly includes a Verification Protocol and Anti-Patterns section to guide manual review of generated code. Capability inventory: The skill has the ability to make network requests via curl and write generated files to the local file system. Sanitization: Structural validation is performed by scripts/validate.js using an AST parser to ensure native primitives are used and best practices are followed.
Audit Metadata