Google Stitch Workflow

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:36 AM UTC
• Version: 1.8.0

Overview

The skill is a coherent Google Stitch workflow guide, but it recommends mutable external tooling and agent/runtime configuration patterns that users should review carefully before installing.

Install only if you are comfortable reviewing each setup step manually. Pin any npm or npx package versions, avoid putting generated or website-derived DESIGN.md content in system prompts or persistent rules files, inspect new dependencies before installing them, and keep Stitch/API credentials and MCP configuration limited to the projects that need them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: references/sections/core-operating-model.md:219

Finding

Unpinned MCP Package Execution Through npx

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/sections/creative-direction-and-design-system.md:107

Finding

Unpinned Design Validation Tools Executed Through npx

Content

View full analysis

Remediation

View remediation

lint DESIGN.md ``` This requires the pinned package to be installed locally first. - Add the reviewed package to development dependencies and commit the package lockfile. - Use lockfile-enforced installation, such as `npm ci`, rather than resolving a new version during each validation pass. - Review package lifecycle scripts and provenance before installation. - Run validation in a sandbox with access limited to the necessary design files. - Require explicit user approval before introducing this dependency into a project that does not already use it. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/sections/export-and-code-translation.md:317

Finding

Generated Stitch Code Can Select npm Dependencies for Installation

Content

View full analysis

` before integration to prevent build failures. ``` ### Technical Analysis The package name represented by `` is derived from generated or exported Stitch code. Generated content is not an authoritative dependency manifest and may be influenced by prompts, external references, compromised upstream services, or model errors. The instruction does not require package allowlisting, exact version pinning, provenance validation, lockfile review, lifecycle-script inspection, or user approval. As a result, a hallucinated, typo-squatted, malicious, or unnecess ...[truncated 1362 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: references/sections/creative-direction-and-design-system.md:79

Finding

Externally Derived DESIGN.md Content Can Be Promoted Into Agent Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · references/sections/core-operating-model.md (reported line 295)May include surrounding context.

md

1. ingest high-signal sources (videos, docs, release notes)
2. extract only reusable transfer rules (not source trivia)
3. require at least two examples before promoting a new rule
4. encode rules as objective pass/fail checks where possible
5. write changelog entries with concrete behavioral impact
6. revalidate dated claims about models, pricing, beta features, and browser-only behavior before turning them into operating rules

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The documentation instructs users to run npx @google/design.md lint DESIGN.md without pinning a specific package version. Because npx resolves and executes the latest published package by default, a compromised upstream release or unexpected breaking change could result in execution of unreviewed code on the user's machine. In this skill context, the command is presented as part of a normal validation workflow, which increases the chance that users will run it directly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The command npx @google/design.md diff DESIGN-before.md DESIGN-after.md invokes an unpinned package from the registry at execution time. This creates a supply-chain risk: if the package is replaced, compromised, or updated unexpectedly, users may execute malicious or untested code simply by following the documentation. The surrounding guidance encourages repeated use in the edit loop, making exposure more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.