stitch-mcp-upload-screens-from-images
Pass
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script (
scripts/encode-image.sh) to perform Base64 encoding of image files. The script includes basic validation to ensure the file exists and has an image-related extension (png, jpg, jpeg, webp, gif). - [EXTERNAL_DOWNLOADS]: No external scripts or packages are downloaded or executed. All operations are performed using local files and pre-defined tools.
- [DATA_EXFILTRATION]: The skill transmits Base64-encoded image data to the
upload_screens_from_imagestool. This is the intended primary purpose of the skill and occurs within the context of the user-authorized Stitch project workflow. - [CREDENTIALS_UNSAFE]: No hardcoded API keys, tokens, or other sensitive credentials were found in the skill or its associated script.
Audit Metadata