stitch-upload-to-stitch
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references source material from the google-labs-code organization on GitHub. As this is a trusted organization, these references are considered safe. The Python script also suggests the installation of the certifi package for SSL certificate handling, which is a standard security practice.
- [COMMAND_EXECUTION]: The skill executes a local Python script upload_to_stitch.py to handle file uploads. This is used to bypass token limits inherent in base64 encoding within the AI's direct output. The script uses standard libraries and performs a specific, documented task.
- [DATA_EXFILTRATION]: The skill reads local files and uploads them to stitch.googleapis.com. This network operation is directed to a trusted service provider (Google) and requires explicit user confirmation of the file paths and destination project before execution.
- [CREDENTIALS_UNSAFE]: The skill provides instructions for retrieving an API key from the local environment or configuration files. It includes safety guidelines that strictly forbid printing, copying, or committing these credentials to chat or logs.
Audit Metadata