stitch-upload-to-stitch
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the standard Python package
certififor SSL certificate verification during API requests. - [COMMAND_EXECUTION]: The workflow requires executing a local Python script
scripts/upload_to_stitch.pyto handle the file upload process. - [DATA_EXFILTRATION]: The skill is designed to transmit local file content (base64-encoded) and a user-provided API key to the official Google Stitch API endpoint at
https://stitch.googleapis.com. - [CREDENTIALS_UNSAFE]: The skill documentation explicitly instructs the agent never to print, commit, or store the Stitch API key, providing guidelines for safe handling as a command-line argument.
Audit Metadata