stitch-sdk-pipeline
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npm runandbuncommands to execute various stages of a build pipeline (capture, generate, build, test). These commands are standard for a TypeScript/Node.js development environment. - [CREDENTIALS_UNSAFE]: The skill references
STITCH_API_KEYandGEMINI_API_KEYbut correctly instructs the user to set them as environment variables rather than hardcoding them. This is a recommended security practice. - [DATA_EXPOSURE]: The skill accesses local project files (e.g.,
tools-manifest.json,domain-map.json,.env) to perform its generation and testing tasks. There is no evidence of these files being exfiltrated to unauthorized domains; network operations are limited to the SDK's intended API testing in Stage 7.
Audit Metadata