stitch-vue-layui-components

Fail

Audited by Snyk on Mar 6, 2026

Risk Level: HIGH
Full Analysis

HIGH W007: Insecure credential handling detected in skill instructions.

  • Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs the agent to insert the htmlCode.downloadUrl verbatim into a bash command (bash scripts/fetch-stitch.sh "<htmlCode.downloadUrl>" ...), which can expose signed URLs or other sensitive tokens if those URLs contain secrets, so the LLM would need to handle/output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

  • Third-party content exposure detected (high risk: 0.90). The skill explicitly retrieves and downloads Stitch screen HTML via stitch-mcp-get-screen (htmlCode.downloadUrl) and the scripts/fetch-stitch.sh step and then parses that HTML as part of the conversion workflow, so untrusted/user-generated Stitch content could influence parsing and subsequent code-generation actions.
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 6, 2026, 08:32 AM