stitch-vue-vant-components
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script
scripts/fetch-stitch.shand usesnpmfor project setup and running the development server. - [EXTERNAL_DOWNLOADS]: Fetches design files and screenshots from Google Cloud Storage domains using
curlwithin a provided script. These downloads originate from trusted infrastructure associated with the Stitch service. - [PROMPT_INJECTION]: The skill processes external data, creating an indirect prompt injection surface: (1) Ingestion points: Fetched HTML design files stored in
temp/source.html. (2) Boundary markers: No explicit delimiters or instruction-bypass warnings are defined for the ingested content. (3) Capability inventory: Access to shell execution (Bash), file system operations (Read/Write), and networking (web_fetch). (4) Sanitization: There is no specified sanitization or validation of the external HTML before it is parsed for component generation.
Audit Metadata