stitch

Pass

Audited by Gen Agent Trust Hub on Apr 23, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides a command-line interface (CLI) named stitch to interact with the Google Stitch service.
  • Evidence: The SKILL.md file and src/cli.ts define various commands for project and screen management, such as stitch project create and stitch screen generate.
  • [EXTERNAL_DOWNLOADS]: The skill resolution logic can trigger a download of the CLI tool from the public npm registry at runtime.
  • Evidence: SKILL.md includes a fallback resolution path using npx -y stitch-design-cli if the binary is not found on the system path.
  • [SAFE]: The skill implements secure credential management for sensitive API keys and OAuth tokens.
  • Evidence: src/config.ts ensures that the local configuration file (~/.config/stitch/config.json) is stored with restricted permissions (0o600) and provides a redactSecret function to prevent full keys from appearing in logs or status output.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 23, 2026, 07:40 AM