StitchFlow

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:39 AM UTC
• Version: 1.3.0

Overview

StitchFlow appears purpose-built for UI design generation, but its workflow gives broad implicit activation and shell-command templates that can carry user-derived text without clear safety boundaries.

Install only if you are comfortable with design briefs and product context being sent through the local Stitch toolkit/API and saved under the toolkit runs directory. Use explicit invocation, avoid pasting untrusted text into prompts or ids, and prefer a launcher that passes arguments without shell interpolation or supports prompt files/strict id validation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: workflows/text-to-design.md:19

Finding

User-Controlled Prompt Interpolation into Shell Command Templates

Content

View full analysis

Vulnerability Details

File Location: workflows/text-to-design.md:19-21, workflows/edit-design.md:23-31, and workflows/variants.md:19-21
Vulnerability Type: Shell command injection through unsafe handling of user-derived arguments
Risk Level: High

Affected code snippets:

workflows/text-to-design.md:19-21

bash

cd "${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}"
npm run generate -- --prompt "..." [--project-id ...] [--device DESKTOP]

workflows/edit-design.md:23-31

bash

cd "${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}"
npm run edit -- --prompt "..."

Or target a specific screen:

bash

cd "${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}"
npm run edit -- --project-id ... --screen-id ... --prompt "..."

workflows/variants.md:19-21

bash

cd "${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}"
npm run variants -- --prompt "..." --variant-count 3

Technical Analysis

These workflows direct the agent to derive a prompt from user-controlled content and substitute it into shell command templates. They do not require a non-shell process API, strict argument validation, a safe prompt-input file, or robust shell escaping.

Enclosing a substituted value in double quotes is not sufficient protection when a command is interpreted by a shell. Shell constructs such as command substitution, backticks, embedded quote termination, and certain expansions can still be evaluated if the agent constructs the final command as text. The project and screen identifiers shown in the edit and generation templates are likewise not subject to documented validation.

This is an instruction-level unsafe coding pattern rather than evidence that the repository itself contains an active malicious payload. Exploitability depends on the invoking agent replacing the placeholders with untrusted values and executing the assembled command through a shell.

Atta

...[truncated 1619 chars]

Remediation

View remediation

Remediation Suggestions

1. Invoke the CLI through a process execution API that accepts an executable and an argument array, with shell processing explicitly disabled. For example, pass npm, run, generate, --, --prompt, and the prompt as separate arguments rather than constructing one command string.
2. Do not use exec, sh -c, bash -c, or equivalent shell-evaluated command strings for user-derived prompts.
3. If the agent environment only supports shell execution, write the prompt to a securely created temporary file and update the toolkit to accept a --prompt-file option. Use restrictive file permissions and delete the file after use.
4. Validate project-id and screen-id values with strict allowlists appropriate to the Stitch API. Reject whitespace, shell metacharacters, option prefixes, path separators, and values outside the expected format.
5. Use an explicit allowlist for --device, --creative-range, and --aspects.
6. Add workflow instructions stating that user content must never be directly interpolated into shell command text.
7. Run the toolkit under a least-privileged account and restrict read access to .env so unrelated processes and users cannot access the API key.
8. Add security tests containing quotes, backticks, $(), semicolons, newlines, and option-injection payloads to confirm that all supplied text is delivered as a single literal argument.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises creating local HTML, screenshots, and other design artifacts, but the top-level description does not clearly warn that execution will write files to a local runs directory. Lack of upfront persistence disclosure can surprise users, expose sensitive prompt or product-context data to disk, and create privacy or data-handling issues in shared environments.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill’s activation description is broad enough to trigger on common UI/design requests without clearly requiring explicit user intent to use StitchFlow or consent to local artifact generation. In agent environments, over-broad routing can cause unnecessary access to local toolchains, external APIs, and file-writing behavior that the user did not specifically request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'When to use' triggers are ambiguous phrases such as wanting a screen generated from a brief or wanting visual edits, which are common requests that may overlap with many non-Stitch tasks. This increases the chance of accidental skill activation, potentially sending user content to the Stitch service and persisting outputs locally without sufficiently clear boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill enables implicit invocation without any visible trigger constraints, which can cause the agent to activate this capability based on broad or ambiguous user requests. Because this skill can generate screens, edit designs, and save local HTML/screenshots, unintended invocation could expose user context to the tool or cause side effects such as local artifact creation without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.