stitch-loop
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements an autonomous loop architecture by reading task instructions from
.stitch/next-prompt.mdat the start of each cycle. This allows external data or previous outputs to influence the agent's logic in subsequent iterations. * Ingestion points: Reads instructions from.stitch/next-prompt.md(Step 1 of the Execution Protocol). * Boundary markers: The skill uses YAML frontmatter to identify the target page name but does not implement sanitization or 'ignore' instructions for the prompt body. * Capability inventory: The agent has access toBash,Write, and the Stitch MCP server tools for project manipulation and asset generation. * Sanitization: There is no validation or filtering of the instructions retrieved from the baton file before they are used to drive the next iteration. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to runnpx serveto host the generated site for visual verification using Chrome DevTools. - [EXTERNAL_DOWNLOADS]: Fetches HTML source code and image assets from URLs provided by the Stitch MCP server. These resources are typically hosted on Google-managed infrastructure.
Audit Metadata