Skip to content
skillsafebeta
← Report library
Purpose / Other

Design Md Skill Security Audit

What the author says it does (original text)

Analyze Stitch projects and synthesize a semantic design system into DESIGN.md files

Independent security check

Security risks found

Files checked
3
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The installation command fetches and runs remote package code through npx

Source references: 1
What we found

The README directs the user to run `npx skills add`. npx and the installer it launches can execute code obtained from a package registry, while the supplied files specify no pinned version, hash, or inventory of executed code.

Why this matters

If the package, a dependency, publisher account, or registry content is compromised, installation could read or modify files with the user's privileges, access available credentials, or install Skill content different from what was audited.

The installation uses `npx skills add` without pinning a package version or repository commit and requests a global install. What is installed therefore depends on the resolved `skills` tool and remote repository state at that time, potentially affecting the user's global skill directory. No hash or version constraint is provided. The user can ask for a pinned trusted version/commit and inspect it in isolation first.

README.md:3In the instructionsOpen original file
## Install```bashnpx skills add google-labs-code/stitch-skills --skill design-md --global```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Low risk

Missing project IDs cause the full owned-project catalog to enter agent context

Source references: 1
What we found

The discovery step explicitly calls list_projects to retrieve “all user projects,” although only one target is ultimately analyzed. This exposes names, identifiers, or URL patterns for unrelated projects to the agent and potentially its logs.

Why this matters

The existence and names of other clients, internal projects, or unreleased work may be retained in the agent session, expanding the data exposed for a single design-analysis task. The supplied instructions do not direct that list to an outside recipient.

Only when no project ID is supplied, the skill lists all owned projects and then selects the target by title or URL pattern. This can expose catalog information about unrelated projects to the executing agent and possible tool logs; the source does not specify field minimization. The user can provide the exact project ID or ask for a server-side exact-title lookup with minimal returned fields.

SKILL.md:35In the instructionsOpen original file
2. **Project lookup** (if Project ID is not provided):   - Call `[prefix]:list_projects` with `filter: "view=owned"` to retrieve all user projects   - Identify the target project by title or URL pattern   - Extract the Project ID from the `name` field (e.g., `projects/13534454087919359824`)
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

The fixed DESIGN.md output name may overwrite an existing design document

Source references: 3
What we found

The workflow directly instructs the agent to create DESIGN.md in the project directory, without first checking for an existing file, requesting confirmation, preserving a backup, or choosing a new filename.

Why this matters

If a same-named file already exists, manually maintained rules or uncommitted content could be replaced. Because the file is described as the source of truth for future screen generation, the replacement could also steer later design decisions.

This is an active file-writing instruction: the skill requires the fixed name `DESIGN.md` in the project directory but provides no check, backup, or confirmation step for an existing file. If the agent's write tool overwrites existing paths, an existing design document could be replaced. The user can restrict output to a new directory or ask for a stop-and-confirm rule when the file exists.

SKILL.md:13In the instructionsOpen original file
You are an expert Design Systems Lead. Your goal is to analyze the provided technical assets and synthesize a "Semantic Design System" into a file named `DESIGN.md`.
Show 2 other places
SKILL.md:17In the instructionsOpen original file
This skill helps you create `DESIGN.md` files that serve as the "source of truth" for prompting Stitch to generate new screens that align perfectly with existing design language. Stitch interprets design through "Visual Descriptions" supported by specific color values.
SKILL.md:144In the instructionsOpen original file
5. **Generate the file:**   - Create `DESIGN.md` in the project directory   - Follow the prescribed format exactly   - Ensure all color codes are accurate
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The wildcard Stitch permission is broader than the documented read workflow

Source references: 4
What we found

The permission declaration allows `stitch*:*`, matching every tool under a Stitch prefix, while the workflow expressly needs only discovery, listing, and retrieval of projects or screens. If the server also exposes creation, update, deletion, or sharing tools, those may be authorized too.

Why this matters

An agent influenced by a mistaken instruction or processed content could invoke Stitch operations unrelated to design-document generation and alter a project or its sharing state.

The permission list grants the wildcard `stitch*:*`, while the documented workflow names discovery, listing, and project/screen retrieval calls. If a matching Stitch service also exposes modification, deletion, or sharing tools, this declaration does not restrict the agent to read-only operations. The user can ask for an explicit allowlist of read-only tools and disable write-capable tools at the connection.

SKILL.md:4In the instructionsOpen original file
description: Analyze Stitch projects and synthesize a semantic design system into DESIGN.md filesallowed-tools:  - "stitch*:*"  - "Read"  - "Write"  - "web_fetch"---
Show 3 other places
SKILL.md:45In the instructionsOpen original file
4. **Metadata fetch**:    - Call `[prefix]:get_screen` with both `projectId` and `screenId` (both as numeric IDs only)   - This returns the complete screen object including:
SKILL.md:58In the instructionsOpen original file
6. **Project metadata extraction**:   - Call `[prefix]:get_project` with the project `name` (full path: `projects/{id}`) to get:     - `designTheme` object with color mode, fonts, roundness, custom colors
SKILL.md:31In the instructionsOpen original file
To analyze a Stitch project, you must retrieve screen metadata and design assets using the Stitch MCP Server tools:1. **Namespace discovery**: Run `list_tools` to find the Stitch MCP prefix. Use this prefix (e.g., `mcp_stitch:`) for all subsequent calls.2. **Project lookup** (if Project ID is not provided):   - Call `[prefix]:list_projects` with `filter: "view=owned"` to retrieve all user projects   - Identify the target project by title or URL pattern
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill retrieves projects, screens, HTML/CSS, and design metadata through Stitch MCP, then generates DESIGN.md in the project directory.

View source
README.md:30In the instructionsOpen original file
1. **Retrieval**: Uses the Stitch MCP Server to fetch project screens, HTML code, and design metadata.2. **Extraction**: Identifies design tokens including colors, typography, spacing, and component patterns.3. **Translation**: Converts technical CSS/Tailwind values into descriptive, natural design language.4. **Synthesis**: Generates a comprehensive DESIGN.md following the semantic design system format.5. **Alignment**: Ensures output follows Stitch Effective Prompting Guide principles for optimal screen generation.
SKILL.md:144In the instructionsOpen original file
5. **Generate the file:**   - Create `DESIGN.md` in the project directory   - Follow the prescribed format exactly   - Ensure all color codes are accurate

When no project ID is supplied, the Skill enumerates every Stitch project owned by the user and then identifies the target by title or URL pattern.

View source
SKILL.md:35In the instructionsOpen original file
2. **Project lookup** (if Project ID is not provided):   - Call `[prefix]:list_projects` with `filter: "view=owned"` to retrieve all user projects   - Identify the target project by title or URL pattern   - Extract the Project ID from the `name` field (e.g., `projects/13534454087919359824`)

The Skill downloads full HTML/CSS from URLs returned by Stitch and may download screenshots; its declared tool permissions also include file writing and network requests.

View source
SKILL.md:4In the instructionsOpen original file
description: Analyze Stitch projects and synthesize a semantic design system into DESIGN.md filesallowed-tools:  - "stitch*:*"  - "Read"  - "Write"  - "web_fetch"---
SKILL.md:53In the instructionsOpen original file
5. **Asset download**:   - Use `web_fetch` or `read_url_content` to download the HTML code from `htmlCode.downloadUrl`   - Optionally download the screenshot from `screenshot.downloadUrl` for visual reference   - Parse the HTML to extract Tailwind classes, custom CSS, and component patterns
Start here · InstructionsSKILL.md
design-md
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • examples/DESIGN.mdFull text included
  • README.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • README.mdSupporting file
  • SKILL.mdInstructions
  • examples/DESIGN.mdSupporting file

Operations mentioned in code and instructions

Run commands
README.md:5In the instructionsOpen original file
```bashnpx skills add google-labs-code/stitch-skills --skill design-md --global
Install extra software packages
README.md:6In the instructionsOpen original file
```bashnpx skills add google-labs-code/stitch-skills --skill design-md --global```
Connect to websites
SKILL.md:23In the instructionsOpen original file
- A Stitch project with at least one designed screen- Access to the Stitch Effective Prompting Guide: https://stitch.withgoogle.com/docs/learn/prompting/
SKILL.md:136In the instructionsOpen original file
   Review the Stitch Effective Prompting Guide at:   https://stitch.withgoogle.com/docs/learn/prompting/   ```
Lines read
363
File checksum (to compare versions)
48ec4b76546ff99323bd592505de35e812e3ec7f48c7e4865144c57079244eaf