stitch-skills
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches configurations and installs packages using npx from well-known services (shadcn-ui, Remotion) and the author's own repository (akillness/oh-my-skills).
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute commands for project initialization, component management, and video generation.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it transforms untrusted user-supplied descriptions into functional UI code and designs. * Ingestion points: User-provided natural language prompts for generating UI screens and multi-page websites in SKILL.md. * Boundary markers: None explicitly defined to prevent the agent from obeying instructions embedded within the user's design request. * Capability inventory: The skill uses Bash for command execution and Write for file system modifications. * Sanitization: No specific input validation or sanitization of the user prompt is described in the mission instructions.
Audit Metadata