0337446, the version that was reviewed and scanned here, and Claude Code installs exactly that commit. Newer commits reach this catalog only after a new review. License: Apache-2.0, by google-labs-code.
- Skills
/stitch-design:code-to-design/stitch-design:extract-design-md/stitch-design:extract-static-html/stitch-design:generate-design/stitch-design:manage-design-system/stitch-design:upload-to-stitch
This is the author's README: its install commands may install another version. stitch-design@aitmpl installs commit 0337446, the one listed and scanned here.
stitch-design
Design workflows for Google Stitch — convert code to designs, generate screens from text/images, manage design systems, extract static HTML, and upload assets.
stitch-design
Design workflows for Google Stitch — convert code to designs, generate screens from text/images, manage design systems, extract static HTML, and upload assets.
Scanned by NVIDIA SkillSpector
Automated static analysis (no LLM) · v2.12.0 · 2026-11-15
Partial analysis: some checks could not run on this component.
SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.
- Agent Config Directory AccessAgent Snooping · skills/upload-to-stitch/SKILL.md:36
- Skill Enumeration ×4Agent Snooping · skills/code-to-design/SKILL.md:37
- Unbounded OutputOutput Handling · skills/extract-static-html/SKILL.md:27
- Unbounded OutputOutput Handling · skills/upload-to-stitch/scripts/upload_to_stitch.py:13
- Without declared permissions the skill's intent is opaque and cannot be validated.MCP Least Privilege · SKILL.md:1
Showing 8 of 25 observations. Learn more about NVIDIA SkillSpector or how components are reviewed.