stitch-mcp-get-screen
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references asset download URLs from
stitch.google.com. These are legitimate resources from a well-known service used for UI design-to-code workflows. - [DATA_EXPOSURE]: The skill processes project and screen identifiers provided by the user to fetch UI code. These identifiers are used solely for the intended function of the skill.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests HTML code and design metadata retrieved from external screens to perform framework conversion.
- Ingestion points: Screen HTML code retrieved from the Stitch API and reference documentation from local skill directories (e.g.,
stitch-uviewpro-components). - Boundary markers: None identified in the prompt templates.
- Capability inventory: The skill uses
Read,Write, andstitch*:*tools to process design data and generate code files. - Sanitization: No explicit sanitization of the retrieved HTML is described before it is used for code generation.
Audit Metadata