stitch-loop

SUSPICIOUS: the skill's website-building behavior is mostly aligned with its purpose, but it grants broad wildcard tool access, includes an autonomous continuation loop, and relies on an unspecified external Stitch MCP service with undocumented provenance. No clear credential harvesting, covert behavior, or incompatible data exfiltration is evident.