stitch-mcp-list-screens
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues or malicious patterns were detected. The skill instructions prioritize read-only discovery and include extensive validation checklists to prevent unauthorized actions.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a data consumer, processing project IDs and screen metadata returned from external tools. Although it lacks explicit boundary markers for third-party tool output, the risk is negligible as the skill is explicitly scoped to read-only operations and strictly forbids the creation, modification, or deletion of resources.
- [DATA_EXPOSURE_&_EXFILTRATION]: The skill includes explicit privacy rules in the 'Rules' section of SKILL.md, directing the agent to ensure that logs, samples, and error messages do not contain tokens, cookies, keys, or sensitive personal data.
Audit Metadata