stitch
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a command-line interface (CLI) named
stitchto interact with the Google Stitch service. - Evidence: The
SKILL.mdfile andsrc/cli.tsdefine various commands for project and screen management, such asstitch project createandstitch screen generate. - [EXTERNAL_DOWNLOADS]: The skill resolution logic can trigger a download of the CLI tool from the public npm registry at runtime.
- Evidence:
SKILL.mdincludes a fallback resolution path usingnpx -y stitch-design-cliif the binary is not found on the system path. - [SAFE]: The skill implements secure credential management for sensitive API keys and OAuth tokens.
- Evidence:
src/config.tsensures that the local configuration file (~/.config/stitch/config.json) is stored with restricted permissions (0o600) and provides aredactSecretfunction to prevent full keys from appearing in logs or status output.
Audit Metadata