stitch-upload
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local data such as HTML and Markdown files, which creates an ingestion surface for potential indirect prompt injection.
- Ingestion points: The
scripts/upload_to_stitch.pyscript reads local file content based on user-provided paths. - Capability inventory: The skill performs network writes to Google's Stitch API and invokes the
upload_design_mdtool. - Boundary markers: The skill documentation (SKILL.md) establishes clear pre-flight and validation checklists to verify intent before execution.
- Sanitization: The instructions explicitly require the agent to desensitize customer data (replacing names, phones, etc., with demo values) before uploading.
- [EXTERNAL_DOWNLOADS]: The skill references and interacts with external infrastructure.
- Fetches implementation guidelines and snapshots from Google Labs' public GitHub repository.
- Targets the official Google Stitch API at
https://stitch.googleapis.comfor asset uploads. - [DATA_EXFILTRATION]: The skill's primary function involves transmitting local data to a remote service, but it implements robust security controls.
- Secure Credentials: It uses a platform secret provider to fetch API keys, ensuring credentials are never passed as command-line arguments or logged.
- Endpoint Pinning: The upload script is hardcoded to use a specific, trusted Google API origin and explicitly disables HTTP redirects to prevent data from being routed to unauthorized hosts.
- Safe Output: The script includes logic to validate API responses and only returns sanitized resource identifiers (screen names) to the user, suppressing the full raw response body.
Audit Metadata