stitch-design-bridge
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Secret Management. The skill explicitly forbids storing credentials in files and instructs the use of environment variables (STITCH_API_KEY). The provided script
scripts/check_stitch_config.pycorrectly redacts sensitive values, showing only the first and last few characters, which is a standard security practice. - [SAFE]: Data Privacy Guidelines. The skill includes a dedicated reference file
references/safety-and-api.mdwhich establishes clear boundaries for external data transfer, specifically listing types of sensitive data (private source code, customer data, .env files) that must not be shared with external services. - [SAFE]: Local Command Execution. The commands listed in the validation section of
SKILL.mdare restricted to local scripts and standard JSON tools used for linting and validating the skill's own directory structure. These do not involve remote code execution or suspicious subprocess calls.
Audit Metadata