OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill enables UI design workflows using the Stitch MCP server but contains a surface for indirect prompt injection and uses local commands for asset management. It analyzes existing designs to build a project's design system, which could be exploited if design files contain malicious instructions. It also uses curl to download design assets.
Detected behaviors
No alerts
2 issues
1/11 files flagged
1 finding · Score: 86/100