stitch-ui-loop
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to iteratively read from and write to specific state files, including a baton file (next-prompt.md) and project constitution files (SITE.md, DESIGN.md). This architecture creates a surface for indirect prompt injection where external data influences agent instructions.
- Ingestion points: The agent reads .stitch/next-prompt.md, .stitch/SITE.md, and .stitch/DESIGN.md at the start of each iteration.
- Boundary markers: Data is structured using YAML frontmatter and specific Markdown headers as specified in baton-schema.md.
- Capability inventory: The skill uses MCP tools for project and screen management, and utilizes bash for file system integration and local serving.
- Sanitization: SKILL.md and anti-patterns.md provide rules for slug validation to prevent directory traversal and mandates the removal of sensitive information like PII and session cookies from output.
- [COMMAND_EXECUTION]: The skill instructions in workflow.md include a visual verification step that uses a shell command (npx serve) to start a local server for testing the generated HTML pages.
- [EXTERNAL_DOWNLOADS]: The skill downloads project assets (HTML and images) from dynamic URLs generated by the Stitch MCP tools and references resources from a Google Labs GitHub repository.
Audit Metadata