0337446, the version that was reviewed and scanned here, and Claude Code installs exactly that commit. Newer commits reach this catalog only after a new review. License: Apache-2.0, by google-labs-code.
- Skills
/stitch-build:react-components/stitch-build:react-native/stitch-build:react-vite-dashboard/stitch-build:remotion/stitch-build:shadcn-ui
This is the author's README: its install commands may install another version. stitch-build@aitmpl installs commit 0337446, the one listed and scanned here.
stitch-build
Code generation and build tools for Google Stitch — convert designs to React components, generate walkthrough videos with Remotion, and integrate shadcn/ui.
stitch-build
Code generation and build tools for Google Stitch — convert designs to React components, generate walkthrough videos with Remotion, and integrate shadcn/ui.
Scanned by NVIDIA SkillSpector
Automated static analysis (no LLM) · v2.12.0 · 2026-11-15
Partial analysis: some checks could not run on this component.
SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.
- MCP Config AccessAgent Snooping · skills/remotion/SKILL.md:35
- Without declared permissions the skill's intent is opaque and cannot be validated.MCP Least Privilege · SKILL.md:1
- npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.MCP Rug Pull · skills/react-components/README.md:6
- npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.MCP Rug Pull · skills/react-native/README.md:6
- npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.MCP Rug Pull · skills/react-vite-dashboard/README.md:8
Showing 5 of 111 observations. Learn more about NVIDIA SkillSpector or how components are reviewed.