The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local bash script (scripts/fetch-stitch.sh) to perform downloads, which is a standard method for handling network requests within this environment.
[EXTERNAL_DOWNLOADS]: Fetches HTML assets from Google Cloud Storage (via the Stitch platform) using curl. This is the intended behavior for analyzing remote design projects and utilizes well-known, trusted infrastructure.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it ingests and analyzes external HTML content provided by the Stitch service.
Ingestion points: The file temp/source.html, which is downloaded from a remote Stitch URL.
Boundary markers: None identified in the analysis instructions.
Capability inventory: The agent has Write access to the file system to create the DESIGN.md file.
Sanitization: No explicit sanitization or validation of the HTML content is performed before analysis.

stitch-design-md