stitch-manage-design-system
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to parse
.stitch/DESIGN.mdfiles to extract design system tokens such as colors, fonts, and layout rules from YAML frontmatter. This process introduces a surface for indirect prompt injection if the design file contains malicious instructions aimed at the agent. - Ingestion points: Reads
.stitch/DESIGN.mdfrom the local file system. - Boundary markers: None identified; the agent is instructed to directly parse and apply the extracted configurations.
- Capability inventory: Includes execution of a local Python script and multiple Stitch-specific MCP tool calls for project and asset management.
- Sanitization: No sanitization or validation of the markdown content is specified.
- [COMMAND_EXECUTION]: Documentation for the skill includes a workflow step that executes a local Python script (
scripts/upload_to_stitch.py) usingpython3. The script handles large file uploads and requires an API key passed via command-line arguments. - Evidence: The
reference/tool-schema.mdfile provides the command:python3 <SKILL_DIR>/scripts/upload_to_stitch.py --project-id <PROJECT_ID> --file-path /path/to/DESIGN.md --api-key <API_KEY>. - Source: The skill and its scripts are identified as being imported from the
google-labs-code/stitch-skillsrepository.
Audit Metadata