stitch-mcp-list-projects

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is designed to list Stitch projects using the stitch*:* toolset. The operations described are consistent with the skill's stated purpose.
  • [PROMPT_INJECTION]: No evidence of instructions attempting to bypass safety filters or override agent behavior was found. The use of 'CRITICAL PREREQUISITE' is a legitimate instructional constraint.
  • [DATA_EXPOSURE]: The skill accesses project metadata such as titles and resource IDs, which is necessary for its core functionality and does not involve sensitive user credentials or unauthorized files.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines an interface for processing project data from an external source (the Stitch API via tools).
  • Ingestion points: Project metadata (name, title) returned by the list_projects tool (SKILL.md).
  • Boundary markers: Absent; the skill does not explicitly define delimiters for tool output.
  • Capability inventory: The skill has access to stitch*:*, Read, and Write tools (SKILL.md frontmatter).
  • Sanitization: No explicit sanitization or validation of the tool output is mentioned.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 04:04 PM
Security Audit — agent-trust-hub — stitch-mcp-list-projects