跳转到正文
报告库
用途分类 / 其他用途

Stitch Design Taste Skill 安全审计

作者说它能做什么(原文)

Semantic Design System Skill for Google Stitch. Generates agent-friendly DESIGN.md files that enforce premium, anti-generic UI standards — strict typography, calibrated color, asymmetric layouts, perpetual micro-motion, and hardware-accelerated performance.

第三方安全检查结论

发现安全风险

已检查文件
2
发现的风险
2
会不会运行危险命令?检查是否下载程序后直接运行、让他人远程控制电脑,或藏起要运行的命令。发现 1 项风险
低风险

后续实现被要求在活动组件上运行无限循环动画

原文依据:5 处
发现了什么

规范明确让编码代理为每个活动仪表板组件实现无限循环动画,并为列表添加级联延迟。

为什么需要注意

当页面包含许多活动组件时,持续动画会增加 CPU/GPU 和电量消耗,并可能给对动态效果敏感的用户造成不适。该材料没有给出关闭条件。

文档明确说明这些不是 Stitch 当前执行的动画,而是交给后续编码代理实现的活动产品行为;其中要求每个活动仪表板组件持续无限循环,并让列表和网格延迟级联出现。这可能造成持续 CPU/电量消耗、分散注意力,且未说明遵循“减少动态效果”偏好。文档虽要求隔离高 CPU 动画并以 60fps 为目标,但这只是性能实现建议,不能消除风险。用户可要求动画默认有限、支持暂停并尊重 reduced-motion。

DESIGN.md:92来自说明文档打开原文件
## 8. Motion & Interaction (Code-Phase Intent)> **Note:** Stitch generates static screens — it does not animate. This section documents the **intended motion behavior** so that the coding agent (Antigravity, Cursor, etc.) knows exactly how to implement animations when building the exported design into a live product.- **Physics Engine:** Spring-based exclusively. `stiffness: 100, damping: 20`. No linear easing anywhere. Premium, weighty feel on all interactive elements- **Perpetual Micro-Loops:** Every active dashboard component has an infinite-loop state — Pulse on status dots, Typewriter on search bars, Float on feature icons, Shimmer on loading states- **Staggered Orchestration:** Lists and grids mount with cascaded delays (`animation-delay: calc(var(--index) * 100ms)`). Waterfall reveals, never instant mount- **Layout Transitions:** Smooth re-ordering via shared element IDs. Items swap positions with physics, simulating real-time intelligence
查看另外 4 个位置
SKILL.md:92来自说明文档打开原文件
- **Spring Physics default:** `stiffness: 100, damping: 20` — premium, weighty feel. No linear easing- **Perpetual Micro-Interactions:** Every active component should have an infinite loop state (Pulse, Typewriter, Float, Shimmer)- **Staggered Orchestration:** Never mount lists instantly — use cascade delays for waterfall reveals- **Performance:** Animate exclusively via `transform` and `opacity`. Never animate `top`, `left`, `width`, `height`. Grain/noise filters on fixed pseudo-elements only
DESIGN.md:95来自说明文档打开原文件
- **Physics Engine:** Spring-based exclusively. `stiffness: 100, damping: 20`. No linear easing anywhere. Premium, weighty feel on all interactive elements- **Perpetual Micro-Loops:** Every active dashboard component has an infinite-loop state — Pulse on status dots, Typewriter on search bars, Float on feature icons, Shimmer on loading states- **Staggered Orchestration:** Lists and grids mount with cascaded delays (`animation-delay: calc(var(--index) * 100ms)`). Waterfall reveals, never instant mount
DESIGN.md:96来自说明文档打开原文件
- **Perpetual Micro-Loops:** Every active dashboard component has an infinite-loop state — Pulse on status dots, Typewriter on search bars, Float on feature icons, Shimmer on loading states- **Staggered Orchestration:** Lists and grids mount with cascaded delays (`animation-delay: calc(var(--index) * 100ms)`). Waterfall reveals, never instant mount- **Layout Transitions:** Smooth re-ordering via shared element IDs. Items swap positions with physics, simulating real-time intelligence
DESIGN.md:99来自说明文档打开原文件
- **Hardware Rules:** Animate ONLY `transform` and `opacity`. Never `top`, `left`, `width`, `height`. Grain/noise filters on fixed, pointer-events-none pseudo-elements only- **Performance:** CPU-heavy perpetual animations isolated in microscopic leaf components. Never trigger parent re-renders. Target 60fps minimum
会不会泄露文件和密钥?检查是否发送含密码或密钥的文件,以及代码里是否直接写了密钥。发现 1 项风险
中风险

生成的页面可能从第三方图片服务加载资源

原文依据:2 处
发现了什么

规范指示使用 picsum.photos 链接。若编码代理照此实现,最终用户的浏览器会直接连接该第三方服务。

为什么需要注意

第三方图片服务可接收到访问者的 IP 地址、请求时间、浏览器网络元数据,以及按浏览器策略提供的来源信息;这也会引入第三方可用性和内容控制依赖。

该要求是实际的反模式规则,不是安全警告或否定示例:它明确把 `picsum.photos` 指定为图片来源。若后续编码代理据此把远程图片 URL 写入页面,访问者的浏览器会向该第三方发送常规网络请求,并可能暴露 IP、请求时间及引用来源等信息。是否实际发生取决于生成页面是否采用该建议。用户可要求作者提供本地素材、可信自有域名或明确的远程资源白名单。

SKILL.md:112来自说明文档打开原文件
- No filler UI text: "Scroll to explore", "Swipe down", scroll arrows, bouncing chevrons- No broken Unsplash links — use `picsum.photos` or SVG avatars- No centered Hero sections (for high-variance projects)
查看另外 1 个位置
DESIGN.md:117来自说明文档打开原文件
- No AI copywriting clichés: "Elevate", "Seamless", "Unleash", "Next-Gen", "Revolutionize"- No broken Unsplash links — use `picsum.photos/seed/{id}/800/600` or SVG UI Avatars- No generic `shadcn/ui` defaults — customize radii, colors, shadows to match this system
会不会删除文件或一直在后台运行?检查是否大范围删除文件、改写磁盘,或设置自动启动。未发现风险
会不会绕过安全保护?检查是否跳过网站安全验证、开放过多文件权限,或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容?检查工作说明是否要求 AI 忽略你的指令、干扰检查结果,或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方?检查是否强制替换推广链接或收款对象,同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

8 个说明模块

该 Skill 的实际内容是设计规范和生成指令:它要求产出 DESIGN.md,并把该文件作为提示 Google Stitch 生成界面的依据。所提供文件中没有可执行脚本、安装命令或凭据处理逻辑。

查看原文
SKILL.md:9来自说明文档打开原文件
## OverviewThis skill generates `DESIGN.md` files optimized for Google Stitch screen generation. It translates the battle-tested anti-slop frontend engineering directives into Stitch's native semantic design language — descriptive, natural-language rules paired with precise values that Stitch's AI agent can interpret to produce premium, non-generic interfaces.The generated `DESIGN.md` serves as the **single source of truth** for prompting Stitch to generate new screens that align with a curated, high-agency design language. Stitch interprets design through **"Visual Descriptions"** supported by specific color values, typography specs, and component behaviors.

DESIGN.md 不只描述静态视觉效果,还明确面向后续编码代理,要求其在实际产品中实现动画行为。

查看原文
DESIGN.md:91来自说明文档打开原文件
## 8. Motion & Interaction (Code-Phase Intent)> **Note:** Stitch generates static screens — it does not animate. This section documents the **intended motion behavior** so that the coding agent (Antigravity, Cursor, etc.) knows exactly how to implement animations when building the exported design into a live product.- **Physics Engine:** Spring-based exclusively. `stiffness: 100, damping: 20`. No linear easing anywhere. Premium, weighty feel on all interactive elements- **Perpetual Micro-Loops:** Every active dashboard component has an infinite-loop state — Pulse on status dots, Typewriter on search bars, Float on feature icons, Shimmer on loading states- **Staggered Orchestration:** Lists and grids mount with cascaded delays (`animation-delay: calc(var(--index) * 100ms)`). Waterfall reveals, never instant mount

规范要求响应式布局、移动端触控尺寸和多个视口测试;这些是设计要求,并没有提供自动测试实现。

查看原文
DESIGN.md:79来自说明文档打开原文件
## 7. Responsive RulesEvery screen must work flawlessly across all viewports. **Responsive is not optional — it is a hard requirement. Every single element must be tested at 375px, 768px, and 1440px.**- **Mobile-First Collapse (< 768px):** All multi-column layouts collapse to a strict single column. `width: 100%`, `padding: 1rem`, `gap: 1.5rem`. No exceptions- **No Horizontal Scroll:** Horizontal overflow on mobile is a critical failure. All elements must fit within viewport width. If any element causes horizontal scroll, the design is broken- **Typography Scaling:** Headlines scale down gracefully via `clamp()`. Body text stays `1rem` minimum. Never shrink body below `14px`. Headlines must remain readable on 375px screens- **Touch Targets:** All interactive elements minimum `44px` tap target. Generous spacing between clickable items. Buttons must be full-width on mobile- **Image Behavior:** Hero and inline images scale proportionally. Inline typography images (photos between words) stack below the headline on mobile instead of inline- **Navigation:** Desktop horizontal nav collapses to a clean mobile menu (slide-in or full-screen overlay). No tiny hamburger icons without labels- **Cards & Grids:** Bento grids and asymmetric layouts revert to stacked single-column cards with full-width. Maintain internal padding (`1rem`)- **Spacing Consistency:** Vertical section gaps reduce proportionally on mobile (`clamp(3rem, 8vw, 6rem)`). Never cramped, never excessively airy- **Testing Viewports:** Designs must be verified at: `375px` (iPhone SE), `390px` (iPhone 14), `768px` (iPad), `1024px` (small laptop), `1440px` (desktop)
从这里开始 · 工作说明SKILL.md
stitch-design-taste
连线表示工作说明包含的模块,不是实际运行顺序。点击模块可查看原文。
文件与检查记录2 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围;纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • DESIGN.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件,没有实际运行 Skill,也没有检查它另外安装的软件包。因此,这不是“保证安全”的承诺;换了版本或使用环境,结果也可能不同。

  • DESIGN.md配套文件
  • SKILL.md工作说明

代码和说明中提到的操作

连接外部网站
SKILL.md:14来自说明文档打开原文件
## Prerequisites- Access to Google Stitch via [labs.google/stitch](https://labs.google/stitch)- Optionally: Stitch MCP Server for programmatic integration with Cursor, Antigravity, or Gemini CLI
读取了多少行
307
文件校验值(用于核对版本)
5b448da0cd5dcc7cb959bd0987f22ae372a7be8fc94baf18d61fad2d8461ce27