stitch-loop

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements an autonomous loop architecture by reading task instructions from .stitch/next-prompt.md at the start of each cycle. This allows external data or previous outputs to influence the agent's logic in subsequent iterations. * Ingestion points: Reads instructions from .stitch/next-prompt.md (Step 1 of the Execution Protocol). * Boundary markers: The skill uses YAML frontmatter to identify the target page name but does not implement sanitization or 'ignore' instructions for the prompt body. * Capability inventory: The agent has access to Bash, Write, and the Stitch MCP server tools for project manipulation and asset generation. * Sanitization: There is no validation or filtering of the instructions retrieved from the baton file before they are used to drive the next iteration.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to run npx serve to host the generated site for visual verification using Chrome DevTools.
  • [EXTERNAL_DOWNLOADS]: Fetches HTML source code and image assets from URLs provided by the Stitch MCP server. These resources are typically hosted on Google-managed infrastructure.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 12:30 PM