Stitch Ui Designer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:16 PM UTC
• Version: 1.0.0

Overview

The skill is meant for UI design, but its setup runs an unpinned npm package and uses Google Cloud authentication, so it needs review before use.

Install only if you trust the `stitch-mcp-auto` package source and are comfortable exposing your local Google Cloud auth context to that MCP process. Prefer pinning the package version, using a dedicated least-privilege Google Cloud project/account, and reviewing the mcporter configuration before running it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:22

Finding

Unpinned Third-Party Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-25
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code Snippet

markdown

1.  **Setup (First Time Only)**
    -   Check if the `stitch` server is configured in `mcporter`.
    -   If not, configure it: `mcporter config add stitch --command "npx" --args "-y stitch-mcp-auto"`
    -   Ensure the user is authenticated with Google Cloud (the tool may prompt for `gcloud auth`).

Technical Analysis

The Skill directs mcporter to register and execute npx -y stitch-mcp-auto without specifying an exact package version. npx may obtain the package dynamically from the configured npm registry, while -y suppresses the package-installation confirmation.

Consequently, the code executed during setup is not immutable relative to the reviewed Skill. A future release of the package—or a release produced after compromise of its publisher or distribution channel—could execute arbitrary JavaScript, package lifecycle hooks, or subprocesses under the Agent user's account. No version lock, integrity hash, trusted-source validation, or isolation control is documented.

The package download is functionally relevant because the Skill requires a Stitch MCP implementation. However, automatically downloading and executing an unpinned version exceeds the minimum safe supply-chain privileges needed to provide that functionality.

Attack Path

1. An attacker compromises the stitch-mcp-auto package, its publisher account, or a relevant package-distribution channel.
2. The attacker publishes a malicious version under the package name expected by the Skill.
3. A user performs the Skill's first-time setup.
4. The documented command causes npx -y to download the currently resolved package version without an interactive confirmation.
5. Attacker-controlled package or lifecycle code executes with the permissions of the Agent user.
6. That code may inspect o ...[truncated 1117 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin stitch-mcp-auto to an exact, reviewed version instead of resolving the latest release, for example:

   text

   mcporter config add stitch --command "npx" --args "-y stitch-mcp-auto@1.2.3"
   

2. Verify that the package name, publisher, repository, and distribution source are official and explicitly document those identifiers.
3. Use a lockfile and npm integrity metadata where the deployment model permits it. Prefer installation from a reviewed dependency manifest over dynamic execution through npx -y.
4. Re-audit package updates before changing the pinned version.
5. Avoid suppressing installation confirmation unless required for controlled automation.
6. Run the MCP package in an isolated, least-privileged environment with restricted filesystem, environment-variable, credential, and network access.
7. Provide only narrowly scoped Google Cloud credentials and IAM roles required for Stitch operations. Do not expose unrelated cloud credentials to the MCP process.
8. Consider maintaining a verified internal package mirror or approved artifact with integrity checks for reproducible deployment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.