Stitch Design Agent

Skill for an agent that integrates designs generated by Google Stitch directly into an app under development. Use this skill whenever the agent needs to: aut...

Before installing, confirm the skill's origin (homepage/owner) and ask the publisher to fix the metadata to list STITCH_TOKEN (and any service-account key) as required. Do not grant a token with the cloud-platform scope unless you understand and accept the broad GCP privileges; prefer a least-privilege scope if Stitch exposes one. Expect the agent to write files into your repo and run build/lint commands — run this in a sandbox or on a branch, review generated code before committing, and ensure CI/linters/tests gate commits. If using a service account, store keys securely and restrict them to only the APIs needed. If the publisher cannot justify the scopes/credentials or provide a trustworthy homepage/source, treat the skill with caution and avoid installing it in production environments.

Type: OpenClaw Skill Name: stitch-design-agent Version: 1.0.2 The skill requests an overly broad Google OAuth scope (cloud-platform) for a UI design task and utilizes high-risk capabilities including arbitrary shell execution (bash), file system modification (file_write), and external network requests. While the workflow in SKILL.md aligns with the stated purpose of integrating AI-generated designs, the combination of broad permissions and the potential for Remote Code Execution via the integration of unvetted code from an external API (stitch.googleapis.com) poses a significant security risk. No clear evidence of intentional malice or data exfiltration was found, but the over-privileged scope and execution capabilities warrant a suspicious classification.