stitch::upload-to-stitch
Fail
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructions direct the agent to harvest API keys from sensitive configuration files belonging to other applications, specifically
~/.claude.json,~/.gemini/settings.json, and.gemini/antigravity/mcp_config.json. - [CREDENTIALS_UNSAFE]: Sensitive API keys are passed as plain-text command-line arguments to the
upload_to_stitch.pyscript via the--api-keyflag, which exposes them in system process lists. - [DATA_EXFILTRATION]: The skill reads local files (images, HTML, Markdown) and transmits their contents to an external API (stitch.googleapis.com).
- [COMMAND_EXECUTION]: The skill utilizes the
run_command(Bash) tool to execute a Python script that performs network operations and file reading. - [PROMPT_INJECTION]: The skill instructions include explicit 'IMPORTANT' markers that command the agent to bypass standard tool calls in favor of the provided script, potentially overriding default safety behaviors for data handling.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local files for upload without explicit sanitization or boundary markers between the data and the execution logic.
- Ingestion points: Local files specified by the
--file-pathargument inupload_to_stitch.py. - Boundary markers: Absent; there are no delimiters or instructions to ignore embedded content within the files being read.
- Capability inventory: File reading via Python's
open(), network transmission viaurllib.request.urlopen, and shell execution viarun_command. - Sanitization: Absent; the script performs a direct base64 encoding and transmission of the raw file content.
Recommendations
- AI detected serious security threats
Audit Metadata