stitch-skills

SUSPICIOUS. The core purpose is coherent for a Stitch UI workflow skill, and the main google-labs-code repo appears legitimate, but the skill meaningfully expands trust by instructing transitive skill installation and by advertising an unrelated third-party repo install path. No direct credential theft or exfiltration is shown here, yet the install footprint is broader and less consistent than necessary for the stated purpose.