stitch-ui-guide
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill functions as a documentation and reference guide for design principles. It contains no executable code, scripts, or binary assets.
- [SAFE]: The workflow defined in
SKILL.mdand the validation checklists inreferences/emphasize safety protocols, such as 'least privilege', 'privacy security' (prohibiting the logging of tokens or keys), and 'read-before-write' verification. - [EXTERNAL_DOWNLOADS]: The skill references external resources for documentation purposes. These include official Google documentation (
stitch.withgoogle.com), the vendor's own GitHub repository for color guides, and a recognized UI design article on WeChat. These references are informational and comply with the trust scope for well-known and vendor-owned services. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user queries regarding UI layouts and styles to provide design advice. While this creates a theoretical attack surface for indirect prompt injection, the skill includes explicit workflow steps for intent clarification and pre-flight checks, and it lacks high-privilege tools that could be exploited in this context.
Audit Metadata