The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local script scripts/fetch-stitch.sh. This script is utilized to download HTML source files from URLs provided by the Stitch MCP tool. While it executes shell commands, the behavior is transparent and tied to the skill's core functionality of retrieving design assets.
[EXTERNAL_DOWNLOADS]: The skill performs external network requests via curl within the fetch-stitch.sh script to download design content from Google Cloud Storage. It also references official documentation and component repositories from well-known sources such as uviewui.com and GitHub. These operations are consistent with the intended use case of fetching assets for code generation.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted external data.
Ingestion points: The scripts/fetch-stitch.sh script downloads Stitch-generated HTML to a local file (temp/source.html), which the agent then parses to generate Vue code.
Boundary markers: There are no explicit instructions or delimiters defined to ignore potential malicious instructions embedded within the source HTML metadata or comments.
Capability inventory: The skill possesses Write capabilities to create and modify project files and Bash capabilities to execute scripts, which could be leveraged if the agent is manipulated by instructions in the ingested data.
Sanitization: There is no mention of sanitization or validation of the downloaded HTML content before it is processed by the AI for code mapping.

stitch-uview-components