stitch-loop
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates on a 'baton-passing' logic where it reads instructions from a local file (.stitch/next-prompt.md) to determine its next actions. This pattern creates a feedback loop vulnerable to indirect prompt injection if the file is modified by untrusted processes or poisoned by previous model outputs.
- Ingestion points: The agent parses .stitch/next-prompt.md to extract the page name and prompt content in Step 1.
- Boundary markers: The instructions specify parsing YAML frontmatter and a markdown body but do not include sanitization or validation of the input content.
- Capability inventory: The skill instructions involve the use of subprocess execution via shell commands, file system modifications, and browser automation across its operational steps.
- Sanitization: There is no evidence of sanitization for the content ingested from the baton file.
- [COMMAND_EXECUTION]: The agent is instructed to execute shell commands to start a local development server.
- Evidence: SKILL.md Step 4.5: 'Use Bash to start a local server (e.g., npx serve site/public)'.
- [EXTERNAL_DOWNLOADS]: The skill downloads website assets from external URLs provided by the Stitch tool outputs.
- Evidence: SKILL.md Step 3.4 identifies download tasks for htmlCode.downloadUrl and screenshot.downloadUrl.
Audit Metadata