stitch-loop
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests natural language instructions from project files such as .stitch/SITE.md and .stitch/next-prompt.md to maintain project memory and task lists, creating a surface for indirect prompt injection. \n
- Ingestion points: Reads baton and project constitution files as described in the workflow (SKILL.md and workflow.md). \n
- Boundary markers: Uses YAML and Markdown for structure but lacks explicit delimiters to ignore instructions within those data files. \n
- Capability inventory: Shell command execution (mv, npx serve), local file system modifications, and Stitch MCP tool calls. \n
- Sanitization: Validates filename slugs to ensure they do not contain directory traversal characters like '..' or '/'. \n- [COMMAND_EXECUTION]: Employs shell commands for file integration and local site preview. \n
- Evidence: Utilizes 'mv' to merge generated pages into the site structure and 'npx serve' to launch a local development server for visual verification (workflow.md). \n- [EXTERNAL_DOWNLOADS]: Fetches assets from dynamic URLs generated by the Stitch MCP server. \n
- Evidence: Downloads HTML source and screenshots from URLs provided in the Stitch response objects (workflow.md Step 3). \n- [REMOTE_CODE_EXECUTION]: References remote repositories for installation and as a definitive implementation basis. \n
- Evidence: Instructions specify installation via 'npx skills' from a public GitHub organization and reference a specific commit on GitHub as a fixed upstream snapshot (README.md, SKILL.md).
Audit Metadata