Stitch Design

Official Google Stitch SDK wrapper for OpenClaw. Requires only STITCH_API_KEY. Generate UI screens from text, apply targeted edits, branch variants, export H...

This skill appears to be what it says: a Node CLI wrapper around Google Stitch that needs only STITCH_API_KEY and writes artifacts under its own folders. Before installing: 1) Confirm the STITCH_API_KEY you supply is limited for Stitch usage (do not reuse high-privilege keys); rotate it if you stop using the skill. 2) Run the `npm install` step in an environment you control (or inspect the scripts/package.json first) because it will pull @google/stitch-sdk and transitive packages. 3) If you want higher assurance, review the main CLI (scripts/stitch.mjs) before use — my assessment used the modules shown but that file is large and not fully included above. 4) Expect the agent to contact stitch.googleapis.com and Google CDN screenshot URLs and to save HTML/PNG and JSON locally under the skill directory. 5) If you have strict network/data policies, run the skill in an isolated environment or container. If you want, I can inspect the full scripts/stitch.mjs for any unexpected network endpoints or behaviors to raise confidence to high.

Type: OpenClaw Skill Name: stitch-design Version: 1.2.3 The stitch-design skill is a legitimate wrapper for the Google Stitch SDK, enabling AI-driven UI generation and iteration. The codebase demonstrates good security practices, including strict regex-based validation for aliases and design system names to prevent path traversal or injection attacks (found in scripts/names.mjs and scripts/design-system.mjs). It manages local artifacts and an append-only event log for design lineage without any evidence of unauthorized data exfiltration, credential theft, or malicious execution. The instructions in SKILL.md are strictly focused on the tool's functional purpose and do not contain harmful prompt injections.