stitch-vue-layui-components
Fail
Audited by Snyk on Mar 6, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs the agent to insert the htmlCode.downloadUrl verbatim into a bash command (bash scripts/fetch-stitch.sh "<htmlCode.downloadUrl>" ...), which can expose signed URLs or other sensitive tokens if those URLs contain secrets, so the LLM would need to handle/output secret values directly.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly retrieves and downloads Stitch screen HTML via stitch-mcp-get-screen (htmlCode.downloadUrl) and the scripts/fetch-stitch.sh step and then parses that HTML as part of the conversion workflow, so untrusted/user-generated Stitch content could influence parsing and subsequent code-generation actions.
Audit Metadata