stitch-loop
Warn
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to move generated files between directories and to launch a local web server using npx serve site/public for visual verification.
- [EXTERNAL_DOWNLOADS]: It downloads code and images from URLs provided by the Stitch MCP server, which are saved to the local file system.
- [PROMPT_INJECTION]: The baton-passing pattern creates a vulnerability to Indirect Prompt Injection. Ingestion points: The skill reads instructions from .stitch/next-prompt.md and context from SITE.md and DESIGN.md. Boundary markers: No delimiters or protective instructions are used when reading these files. Capability inventory: The agent has Bash, Write, and MCP tool access (Stitch, Chrome). Sanitization: No input validation or instruction filtering is performed on the data retrieved from the baton file, which could allow a malicious file to direct the agent toward unauthorized actions.
Audit Metadata