stitch-vue-element-components

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and parses Stitch screen HTML from third-party URLs (via stitch-mcp-get_screen's htmlCode.downloadUrl and the scripts/fetch-stitch.sh download step in SKILL.md) and then the agent is required to interpret that untrusted, user-provided HTML to drive component mapping and code-generation, so external content can materially influence actions.