stitch-swiftui-components
Pass
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads design content from Google Cloud Storage URLs using a provided shell script. This is a core functionality required to retrieve the source designs for conversion.- [COMMAND_EXECUTION]: Utilizes the
Bashtool to execute a script (scripts/fetch-stitch.sh) for downloading remote assets. The script employs best practices, including proper argument quoting and error handling for thecurloperations.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted HTML data from external URLs. - Ingestion points: Data is fetched into
temp/source.htmlvia the fetch script. - Boundary markers: The instructions do not define delimiters or specific safety instructions to ignore potential commands embedded within the design data.
- Capability inventory: The skill uses the
Bashtool for downloads and theWritetool to generate Swift source files on the local filesystem. - Sanitization: No validation or sanitization is performed on the fetched HTML content before it is processed by the agent.
Audit Metadata