stitch-mcp-get-screen
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines logic for extracting resource identifiers (
projectId,screenId) from user-provided URLs and paths. This creates a surface where the agent processes external input to construct tool arguments. The extraction logic is constrained to specific path segments, and the resulting tool call is a scoped read operation, representing a safe handling of untrusted data parameters. - [EXTERNAL_DOWNLOADS]: The skill documentation describes fetching assets from
stitch.google.com, which is a well-known service. These downloads are integral to the skill's purpose of exporting design assets and are documented neutrally as a core functionality. - [SAFE]: The instructions reference other components within the
full-stack-skillsvendor ecosystem, such asstitch-react-componentsandstitch-uview-components. These are managed as vendor resources to provide necessary context for design-to-code conversion tasks and do not introduce external security risks.
Audit Metadata