Skip to content
Report library
Purpose / Other

Stitch Design Taste Skill Security Audit

What the author says it does (original text)

Semantic Design System Skill for Google Stitch. Generates agent-friendly DESIGN.md files that enforce premium, anti-generic UI standards — strict typography, calibrated color, asymmetric layouts, perpetual micro-motion, and hardware-accelerated performance.

Independent security check

Security risks found

Files checked
2
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Low risk

Later implementation is directed to run infinite-loop animations on active components

Source references: 5
What we found

The specification explicitly tells a coding agent to implement infinite-loop states for every active dashboard component and cascaded delays for lists.

Why this matters

With many active components, continuous animation can increase CPU/GPU use and battery consumption and may cause discomfort for motion-sensitive users. The supplied material gives no stopping condition.

The document says these animations are not run by Stitch itself but are implementation instructions for a later coding agent. It requires an infinite loop on every active dashboard component and delayed cascades for lists and grids. This can create continuing CPU/battery use and distraction, with no stated accommodation for reduced-motion preferences. Isolating CPU-heavy animations and targeting 60fps are mitigation guidance, not elimination of the risk. Users can require finite-by-default motion, pause controls, and reduced-motion support.

DESIGN.md:92In the instructionsOpen original file
## 8. Motion & Interaction (Code-Phase Intent)> **Note:** Stitch generates static screens — it does not animate. This section documents the **intended motion behavior** so that the coding agent (Antigravity, Cursor, etc.) knows exactly how to implement animations when building the exported design into a live product.- **Physics Engine:** Spring-based exclusively. `stiffness: 100, damping: 20`. No linear easing anywhere. Premium, weighty feel on all interactive elements- **Perpetual Micro-Loops:** Every active dashboard component has an infinite-loop state — Pulse on status dots, Typewriter on search bars, Float on feature icons, Shimmer on loading states- **Staggered Orchestration:** Lists and grids mount with cascaded delays (`animation-delay: calc(var(--index) * 100ms)`). Waterfall reveals, never instant mount- **Layout Transitions:** Smooth re-ordering via shared element IDs. Items swap positions with physics, simulating real-time intelligence
Show 4 other places
SKILL.md:92In the instructionsOpen original file
- **Spring Physics default:** `stiffness: 100, damping: 20` — premium, weighty feel. No linear easing- **Perpetual Micro-Interactions:** Every active component should have an infinite loop state (Pulse, Typewriter, Float, Shimmer)- **Staggered Orchestration:** Never mount lists instantly — use cascade delays for waterfall reveals- **Performance:** Animate exclusively via `transform` and `opacity`. Never animate `top`, `left`, `width`, `height`. Grain/noise filters on fixed pseudo-elements only
DESIGN.md:95In the instructionsOpen original file
- **Physics Engine:** Spring-based exclusively. `stiffness: 100, damping: 20`. No linear easing anywhere. Premium, weighty feel on all interactive elements- **Perpetual Micro-Loops:** Every active dashboard component has an infinite-loop state — Pulse on status dots, Typewriter on search bars, Float on feature icons, Shimmer on loading states- **Staggered Orchestration:** Lists and grids mount with cascaded delays (`animation-delay: calc(var(--index) * 100ms)`). Waterfall reveals, never instant mount
DESIGN.md:96In the instructionsOpen original file
- **Perpetual Micro-Loops:** Every active dashboard component has an infinite-loop state — Pulse on status dots, Typewriter on search bars, Float on feature icons, Shimmer on loading states- **Staggered Orchestration:** Lists and grids mount with cascaded delays (`animation-delay: calc(var(--index) * 100ms)`). Waterfall reveals, never instant mount- **Layout Transitions:** Smooth re-ordering via shared element IDs. Items swap positions with physics, simulating real-time intelligence
DESIGN.md:99In the instructionsOpen original file
- **Hardware Rules:** Animate ONLY `transform` and `opacity`. Never `top`, `left`, `width`, `height`. Grain/noise filters on fixed, pointer-events-none pseudo-elements only- **Performance:** CPU-heavy perpetual animations isolated in microscopic leaf components. Never trigger parent re-renders. Target 60fps minimum
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Generated pages may load images from a third-party service

Source references: 2
What we found

The specification directs implementers to use picsum.photos URLs. If a coding agent follows this instruction, visitors' browsers will connect directly to that third party.

Why this matters

The image provider can receive visitors' IP addresses, request times, browser/network metadata, and referrer information allowed by browser policy. The site also becomes dependent on the provider's availability and content controls.

This is an active design rule, not a warning or negated example: it explicitly names `picsum.photos` as an image source. If a later coding agent embeds such remote URLs, visitors’ browsers will contact that third party and may disclose ordinary request metadata such as IP address, timing, and referrer. Whether this occurs depends on whether the generated page adopts the suggestion. A user can require local assets, a trusted first-party host, or an explicit remote-resource allowlist.

SKILL.md:112In the instructionsOpen original file
- No filler UI text: "Scroll to explore", "Swipe down", scroll arrows, bouncing chevrons- No broken Unsplash links — use `picsum.photos` or SVG avatars- No centered Hero sections (for high-variance projects)
Show 1 other places
DESIGN.md:117In the instructionsOpen original file
- No AI copywriting clichés: "Elevate", "Seamless", "Unleash", "Next-Gen", "Revolutionize"- No broken Unsplash links — use `picsum.photos/seed/{id}/800/600` or SVG UI Avatars- No generic `shadcn/ui` defaults — customize radii, colors, shadows to match this system
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill consists of design rules and generation instructions: it produces a DESIGN.md intended to prompt Google Stitch to generate interfaces. The provided files contain no executable scripts, installation commands, or credential-handling logic.

View source
SKILL.md:9In the instructionsOpen original file
## OverviewThis skill generates `DESIGN.md` files optimized for Google Stitch screen generation. It translates the battle-tested anti-slop frontend engineering directives into Stitch's native semantic design language — descriptive, natural-language rules paired with precise values that Stitch's AI agent can interpret to produce premium, non-generic interfaces.The generated `DESIGN.md` serves as the **single source of truth** for prompting Stitch to generate new screens that align with a curated, high-agency design language. Stitch interprets design through **"Visual Descriptions"** supported by specific color values, typography specs, and component behaviors.

DESIGN.md goes beyond static visual guidance and explicitly directs a later coding agent to implement animation behavior in the live product.

View source
DESIGN.md:91In the instructionsOpen original file
## 8. Motion & Interaction (Code-Phase Intent)> **Note:** Stitch generates static screens — it does not animate. This section documents the **intended motion behavior** so that the coding agent (Antigravity, Cursor, etc.) knows exactly how to implement animations when building the exported design into a live product.- **Physics Engine:** Spring-based exclusively. `stiffness: 100, damping: 20`. No linear easing anywhere. Premium, weighty feel on all interactive elements- **Perpetual Micro-Loops:** Every active dashboard component has an infinite-loop state — Pulse on status dots, Typewriter on search bars, Float on feature icons, Shimmer on loading states- **Staggered Orchestration:** Lists and grids mount with cascaded delays (`animation-delay: calc(var(--index) * 100ms)`). Waterfall reveals, never instant mount

The specification requires responsive layouts, minimum mobile touch targets, and checks at multiple viewport sizes; these are design requirements rather than an included automated test implementation.

View source
DESIGN.md:79In the instructionsOpen original file
## 7. Responsive RulesEvery screen must work flawlessly across all viewports. **Responsive is not optional — it is a hard requirement. Every single element must be tested at 375px, 768px, and 1440px.**- **Mobile-First Collapse (< 768px):** All multi-column layouts collapse to a strict single column. `width: 100%`, `padding: 1rem`, `gap: 1.5rem`. No exceptions- **No Horizontal Scroll:** Horizontal overflow on mobile is a critical failure. All elements must fit within viewport width. If any element causes horizontal scroll, the design is broken- **Typography Scaling:** Headlines scale down gracefully via `clamp()`. Body text stays `1rem` minimum. Never shrink body below `14px`. Headlines must remain readable on 375px screens- **Touch Targets:** All interactive elements minimum `44px` tap target. Generous spacing between clickable items. Buttons must be full-width on mobile- **Image Behavior:** Hero and inline images scale proportionally. Inline typography images (photos between words) stack below the headline on mobile instead of inline- **Navigation:** Desktop horizontal nav collapses to a clean mobile menu (slide-in or full-screen overlay). No tiny hamburger icons without labels- **Cards & Grids:** Bento grids and asymmetric layouts revert to stacked single-column cards with full-width. Maintain internal padding (`1rem`)- **Spacing Consistency:** Vertical section gaps reduce proportionally on mobile (`clamp(3rem, 8vw, 6rem)`). Never cramped, never excessively airy- **Testing Viewports:** Designs must be verified at: `375px` (iPhone SE), `390px` (iPhone 14), `768px` (iPad), `1024px` (small laptop), `1440px` (desktop)
Start here · InstructionsSKILL.md
stitch-design-taste
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • DESIGN.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • DESIGN.mdSupporting file
  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:14In the instructionsOpen original file
## Prerequisites- Access to Google Stitch via [labs.google/stitch](https://labs.google/stitch)- Optionally: Stitch MCP Server for programmatic integration with Cursor, Antigravity, or Gemini CLI
Lines read
307
File checksum (to compare versions)
5b448da0cd5dcc7cb959bd0987f22ae372a7be8fc94baf18d61fad2d8461ce27