stitch-sdk-bug-bash
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the
@google/stitch-sdkpackage. This dependency is a legitimate resource belonging to the vendor's ecosystem and is used for its intended purpose of SDK functionality testing. - [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from the Stitch SDK API calls.
- Ingestion points: Data returned from SDK methods such as
project.listScreens()inSKILL.md. - Boundary markers: None explicitly defined for external API responses.
- Capability inventory: Logic is restricted to diagnostic console logging (
console.log); no file-system write or external network-send capabilities are implemented in the script. - Sanitization: None present; the skill is designed to log raw output for debugging purposes.
Audit Metadata