stitch

SUSPICIOUS: the skill’s purpose is coherent, but its trust model is not. It presents an unofficial npm CLI as effectively official, executes it via unpinned `npx`, and forwards Stitch credentials to that third-party wrapper, creating disproportionate supply-chain and credential-forwarding risk despite otherwise normal Stitch workflow commands.