ClawHub
Back to skill

Security audit

Stitch Design Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly deceptive, but it gives an agent broad credentials and directs it to automatically add remote-generated code and packages to a project without enough review controls.

Review carefully before installing. Use this only in a disposable or well-backed-up workspace, require the agent to show generated code and diffs before writing, approve every package and exact version manually, and use a dedicated low-privilege Google credential rather than a broad personal or CI token.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:43
Finding

Overly Broad Google Cloud OAuth Scope

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:190
Finding

Unvalidated Remote Code Written and Integrated into the Project

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:250
Finding

Automatic Installation of Dependencies Selected by Untrusted Generated Code

Content
View full analysis
` before integrating. ``` ### Technical Analysis The skill directs the agent to infer missing package names from remotely generated source and install them automatically. The remote response can therefore influence which packages are added to the project. No package allowlist, reviewed version constraint, registry restriction, integrity verification, provenance check, or user-confirmation step is specified. An attacker could induce installation of a malicious, typosquatted, dependency-confusion, or otherwise compromised package. Standard npm installation can execute package lifecycle scripts, making package installation a code-execution boundary rather than a simple source retrieval operation. Using an unpinned `npm install ` command can also select a newer package version than the one previously reviewed, allowing the effective dependency payload to change over time. ### Attack Path 1. A remote design response includes an import for an attacker-selected package name. 2. The agent detects that the package is not installed. 3. Following the skill instructions, the agent executes `npm install `. 4. npm resolves the package from the configured registry without an approved package/version policy. 5. A malicious package or compromised release is downloaded. 6. Package lifecycle scripts execute with the privileges of the agent process, or malicious library code executes later during build or application runtime. 7. The package can access workspace files, environment variables, available credentials, and network resources permitted to that process. ### Impact Assessment Successf ...[truncated 419 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is described as automatically integrating generated code into the active codebase without any explicit user-facing notice or confirmation step. In this context, silent file writes and code injection into an active project can surprise users, overwrite logic, or insert unsafe generated code into trusted paths.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
if (!token) throw new Error('STITCH_TOKEN is not configured');

  // Step 2: Request design from Stitch
  const stitchResponse = await fetch(
    'https://stitch.googleapis.com/v1/designs:generate',
    {
      method: 'POST',

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Broad triggers like generate the view for or create a screen for can cause this skill to activate in many ordinary development contexts, leading to unexpected external API use and code modifications. Because the skill performs autonomous integration and may also run commands, accidental invocation materially increases the chance of unintended workspace changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill authorizes the agent to run npm install <pkg> based on dependencies referenced in generated code from an external service. That extends behavior beyond design retrieval into execution of dependency-changing actions influenced by untrusted remote output, creating supply-chain and workspace integrity risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill permits automatic package installation and command execution (npm install) without a clear warning or consent flow. Allowing an agent to alter dependencies based on generated code substantially raises the risk of unwanted code execution, malicious package installation, and persistent project compromise.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.