stitch-react-vite-dashboard
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Synchronizes workflow metadata and support materials from the official Google Labs Code repository on GitHub. This is an administrative reference for skill maintenance rather than an automated runtime execution of remote code.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external design assets which presents a potential injection surface.
- Ingestion points: Stitch HTML exports, screenshots, and DESIGN.md files.
- Boundary markers: Instructs the agent to treat SKILL.md as the source of truth, but lacks explicit delimiters for untrusted data content.
- Capability inventory: React/Vite code scaffolding, local build execution, and design-system tool access.
- Sanitization: No explicit sanitization or filtering logic is defined for the ingested design artifacts.
- [SAFE]: The skill includes explicit instructions and anti-patterns to prevent the leakage of API keys, cookies, and private keys. It mandates the isolation of data access hooks from presentational components to ensure environment variables and secrets are not accidentally exposed in client-side builds.
Audit Metadata