0337446, the version that was reviewed and scanned here, and Claude Code installs exactly that commit. Newer commits reach this catalog only after a new review. License: Apache-2.0, by google-labs-code.
- Skills
/stitch-utilities:design-md/stitch-utilities:enhance-prompt/stitch-utilities:site-md/stitch-utilities:stitch-loop/stitch-utilities:taste-design
This is the author's README: its install commands may install another version. stitch-utilities@aitmpl installs commit 0337446, the one listed and scanned here.
stitch-utilities
Design utilities and assistants for Google Stitch — generate DESIGN.md specs, enhance prompts, build multi-page sites with stitch-loop, and enforce premium design standards.
stitch-utilities
Design utilities and assistants for Google Stitch — generate DESIGN.md specs, enhance prompts, build multi-page sites with stitch-loop, and enforce premium design standards.
Scanned by NVIDIA SkillSpector
Automated static analysis (no LLM) · v2.12.0 · 2026-11-15
SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.
- Direct Prompt ExtractionSystem Prompt Leakage · skills/design-md/SKILL.md:88
- npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.MCP Rug Pull · skills/design-md/README.md:6
- npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.MCP Rug Pull · skills/enhance-prompt/README.md:6
- npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.MCP Rug Pull · skills/stitch-loop/README.md:8
- npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.MCP Rug Pull · skills/stitch-loop/SKILL.md:114
Learn more about NVIDIA SkillSpector or how components are reviewed.