跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Brand Landingpage Skill 安全审计

作者说它能做什么（原文）

>

第三方安全检查结论

发现安全风险

已检查文件
4
发现的风险
4
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。发现 2 项风险
中风险

会在未明确征得同意时安装或升级 SDK，默认可影响全局开发环境

原文依据：4 处
发现了什么

Phase 0 要求核对“最新版本”，缺失时默认执行全局安装，并要求代理自行处理安装细节。全局安装不是生成落地页所必需的项目内变更，且用户可能不会在执行前看到准确的软件包、版本和命令。

为什么需要注意

可能改变系统级命令或依赖版本，引入供应链代码，并影响同一机器上的其他项目。

Phase 0 明确要求检查最新版，并在缺失时默认安装到全局环境，还要求代理自行处理安装细节。若用户的全局环境可写，这可能新增或升级共享 SDK，影响其他项目；文档未要求先展示包名、版本、命令并取得确认。用户可要求仅使用项目级固定版本，并在任何安装或升级前确认。

SKILL.md:31来自说明文档打开原文件
1. Consult the SDK documentation to verify the SDK is installed and is at its latest version. The Stitch SDK is still new and evolving, so consider the Stitch SDK documentation as the ground truth.2. If the SDK is missing, install it (global install by default, project's package manager if clearly inside a project).3. Verify the API key env var (as named in the docs) is set. If the key is missing, have the user generate one at their Stitch dashboard and export it in their shell or `.env`.4. Make one minimal SDK call to confirm auth. Diagnose and retry once on failure before involving the user.Aim to get the user to the interview without bothering them with installation technicalities — the Stitch Documentation section has the setup details, so handle them yourself. Never display, transcribe, or echo the key.
查看另外 3 个位置
SKILL.md:246来自说明文档打开原文件
## Stitch Documentation- Stitch SDK usage and installation documentation: `https://stitch-design.ai/docs/sdk/ai-sdk`- DESIGN.md documentation and examples: `https://stitch-design.ai/docs/design-md/overview`
SKILL.md:32来自说明文档打开原文件
1. Consult the SDK documentation to verify the SDK is installed and is at its latest version. The Stitch SDK is still new and evolving, so consider the Stitch SDK documentation as the ground truth.2. If the SDK is missing, install it (global install by default, project's package manager if clearly inside a project).3. Verify the API key env var (as named in the docs) is set. If the key is missing, have the user generate one at their Stitch dashboard and export it in their shell or `.env`.
SKILL.md:36来自说明文档打开原文件
Aim to get the user to the interview without bothering them with installation technicalities — the Stitch Documentation section has the setup details, so handle them yourself. Never display, transcribe, or echo the key.
中风险

会自动在浏览器中打开第三方生成的 HTML

原文依据：4 处
发现了什么

Skill 要求保存 Stitch 返回的 HTML，并在每次生成、编辑和变体选择后自动打开。提供的材料没有说明在打开前检查脚本、表单、重定向或外部资源。

为什么需要注意

如果生成内容被污染或服务返回恶意页面，浏览器可能执行其中的脚本、发起外部请求、展示欺骗性登录界面，或泄露浏览器可见的网络信息。浏览器沙箱会限制部分能力，但不会阻止所有联网和欺骗行为。

这是强制执行的活动流程：保存 Stitch 返回的 HTML 后，使用系统命令在用户浏览器中打开，并在每次更新后重复。若生成内容含脚本、表单、重定向或外部资源，浏览器打开时可能执行或联网；所给流程未规定打开前审查或隔离。用户可要求先以文本检查 HTML、禁用网络，或在隔离浏览器中预览。

SKILL.md:165来自说明文档打开原文件
2. Craft the generation prompt using the template from `references/stitch-architecture.md`.3. Call `generate_screen_from_text` with `deviceType: DESKTOP`.4. Generation takes 1-3 minutes. Do NOT retry if it seems slow.5. Save the HTML output returned by your Stitch SDK call into `.stitch/designs/` using a versioned filename: `desktop-v1.html` for the first generation, `desktop-v2.html` for the next iteration, and so on. Use the same convention for mobile (`mobile-v1.html`, `mobile-v2.html`). Use the SDK's response-handling pattern to retrieve the output — don't perform arbitrary HTTP fetches.6. **Open the saved HTML file in the user's browser** so they can see the design at full fidelity. Use `open` (macOS), `xdg-open` (Linux), or `start` (Windows, via `cmd /c start`). If none work in the current environment, tell the user the file path.7. Save the screen ID to `.stitch/metadata.json` under `screens.desktop.current` and append to `screens.desktop.history`.
查看另外 3 个位置
SKILL.md:173来自说明文档打开原文件
After every generation, edit, or variant selection:1. Save the updated HTML from the Stitch SDK response and open the local file in the browser.2. Briefly orient the user: "I've opened the latest version in your browser. Hero section at top with the headline and CTA, then {describe sections}, footer at the bottom."3. Ask the three feedback questions from `references/interview-framework.md`:
SKILL.md:201来自说明文档打开原文件
Save the HTML from each Stitch variant response as `desktop-vN-option-a.html`, `desktop-vN-option-b.html`, `desktop-vN-option-c.html` in `.stitch/designs/` (where `N` is the current iteration number). Open all of them locally so the user can compare in separate tabs. Note one distinguishing feature each. Ask: "Which direction do you prefer? Or should I combine elements from different options?" Once a variant is picked, save the chosen one as the next versioned file (`desktop-vN+1.html`) and continue the loop from there.
SKILL.md:203来自说明文档打开原文件
### Loop Guardrails- **Always open the updated HTML** in the browser after any edit or variant selection.- **Update metadata** after every state change. Never discard previous versions.- **After 3 rounds** of positive feedback: "This is looking solid. Keep iterating or ship it and refine later?"
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 2 项风险
中风险

产品与上线策略信息会发送给第三方 Stitch 服务

原文依据：4 处
发现了什么

该流程收集产品名称、用途、目标受众、CTA 和品牌方向，并将这些内容放入远程项目和页面生成提示。文档没有要求在上传这些信息前单独取得用户同意。

为什么需要注意

尚未发布的产品定位、目标客户、营销文案或商业计划可能进入第三方服务的处理范围和账户项目记录。

流程收集项目用途、目标用户、CTA 和品牌感受；随后把项目名提交给 Stitch 创建项目，并将名称、描述、目标用户、CTA 和品牌形容词写入生成提示。使用 API 密钥进行鉴权表明这是对 Stitch 服务的调用。若这些信息尚未公开，可能造成第三方披露；文档没有单独的上传确认步骤。用户可要求先查看并删减提示中的机密信息。

SKILL.md:87来自说明文档打开原文件
Ask about: product/project name, what it does, who the target users are, what action visitors should take (sign up, try demo, join waitlist, etc.).**Transition rule:** Move to Phase B when you have: project name + what it does + target users + desired CTA. These four are non-negotiable.### Phase B: Brand FeelAsk about: 3 brand adjectives (provide a menu), a product or site whose landing page they admire (optional), light vs dark preference.**Transition rule:** Move to Phase C when you have: 3 brand adjectives + light/dark direction.### Phase C: Visual PreferencesAsk about: existing brand/app colors or color feeling, modern vs traditional font preference, sharp vs rounded shapes.**Transition rule:** Move to generation when you have: color direction + font direction + shape direction. Confirm the full summary with the user before proceeding.
查看另外 3 个位置
SKILL.md:136来自说明文档打开原文件
1. **Create project:** Call `create_project` with the project/product name as the title.2. **Build DesignSystem object** from the translation table above.3. **Create design system:** Call `create_design_system` on the project.4. **Update design system:** Immediately call `update_design_system`. This step is required -- create alone does not render the system.5. **Write DESIGN.md:** Create `.stitch/DESIGN.md` documenting the design system in semantic language:
references/stitch-architecture.md:135来自说明文档打开原文件
```A {DESKTOP|MOBILE} landing page for "{projectName}", {one-sentence description}.Hero: {headline concept} with a clear "{CTA button text}" button.Target users: {target user description}.Mood: {adj1}, {adj2}, {adj3}.
SKILL.md:33来自说明文档打开原文件
2. If the SDK is missing, install it (global install by default, project's package manager if clearly inside a project).3. Verify the API key env var (as named in the docs) is set. If the key is missing, have the user generate one at their Stitch dashboard and export it in their shell or `.env`.4. Make one minimal SDK call to confirm auth. Diagnose and retry once on failure before involving the user.
中风险

用户随手附加的原始图片会被持久保存并复制进交付包

原文依据：4 处
发现了什么

即使用户只是自发附加图片，Skill 也要求保存原文件，随后收集所有用户素材进入最终 ZIP；没有要求检查图像中的机密内容、位置元数据或确认是否允许再分发。

为什么需要注意

内部截图、未发布徽标、个人信息或照片元数据可能被长期保留，并在 ZIP 被分享或部署时一并传播。

当用户自发附图时，流程要求把原文件保存到项目目录，并在交付时收集到 ZIP 的 assets 目录。虽然之后会告知用户文件已保存，但没有要求保存前确认，也没有规定清除 EXIF/位置等元数据或检查敏感画面。因此，附件中的隐私内容可能被持久化并随交付包传播。用户可要求明确选择素材、删除元数据并在打包前复核。

SKILL.md:107来自说明文档打开原文件
IF the user spontaneously attaches an image (logo, app screenshot, design inspiration):1. Ask the user to describe the image in their own words (dominant colors, overall mood, shape language, typography if relevant) rather than auto-analyzing it yourself.2. Save the original file to `.stitch/user-assets/` with a descriptive filename for later handoff.3. Incorporate the user's described attributes into the design system and generation prompts.4. Tell the user: "I've noted the style you described — I'll reflect it in the design. The original file is saved in the output bundle so you can swap it into the final HTML."
查看另外 3 个位置
SKILL.md:236来自说明文档打开原文件
1. Identify the latest approved versions in `.stitch/designs/` (highest `desktop-vN.html`, and `mobile-vN.html` if mobile was generated). Copy them into the bundle root, renaming desktop to `index.html` and mobile to `mobile.html`. Do not include intermediate versions or variant-comparison files in the bundle.2. Generate `color-tokens.json` with primary color, colorMode, colorVariant, fonts, roundness.3. Copy `.stitch/DESIGN.md`.4. Collect user assets from `.stitch/user-assets/` if any exist.5. Generate `DEPLOY.md` using the template in `references/state-and-pitfalls.md`.6. Create the zip: `zip -r "{project-name}-landing-page.zip" "{project-name}-landing-page/"`7. Tell the user: "Bundle is ready at `{path}`. See `DEPLOY.md` for the deployment checklist."
SKILL.md:229来自说明文档打开原文件
    color-tokens.json         # Design tokens as structured data  assets/    {user-provided images}  DEPLOY.md                   # Deployment checklist
SKILL.md:239来自说明文档打开原文件
3. Copy `.stitch/DESIGN.md`.4. Collect user assets from `.stitch/user-assets/` if any exist.5. Generate `DEPLOY.md` using the template in `references/state-and-pitfalls.md`.6. Create the zip: `zip -r "{project-name}-landing-page.zip" "{project-name}-landing-page/"`7. Tell the user: "Bundle is ready at `{path}`. See `DEPLOY.md` for the deployment checklist."
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

8 个说明模块

该 Skill 先收集产品名称、用途、目标用户、CTA 和品牌偏好，再把这些信息转成 Stitch 项目、设计系统和页面生成提示。

查看原文
SKILL.md:87来自说明文档打开原文件
Ask about: product/project name, what it does, who the target users are, what action visitors should take (sign up, try demo, join waitlist, etc.).**Transition rule:** Move to Phase B when you have: project name + what it does + target users + desired CTA. These four are non-negotiable.
SKILL.md:136来自说明文档打开原文件
1. **Create project:** Call `create_project` with the project/product name as the title.2. **Build DesignSystem object** from the translation table above.3. **Create design system:** Call `create_design_system` on the project.4. **Update design system:** Immediately call `update_design_system`. This step is required -- create alone does not render the system.5. **Write DESIGN.md:** Create `.stitch/DESIGN.md` documenting the design system in semantic language:
references/stitch-architecture.md:135来自说明文档打开原文件
```A {DESKTOP|MOBILE} landing page for "{projectName}", {one-sentence description}.Hero: {headline concept} with a clear "{CTA button text}" button.Target users: {target user description}.Mood: {adj1}, {adj2}, {adj3}.Sections:1. Hero with headline, subheadline, and primary call-to-action2. {Second section based on product type}3. {Third section}4. {Fourth section}5. Footer with links and secondary call-to-action```

它会在项目中持续创建 `.stitch` 状态、设计 HTML 和设计文档，并在批准后复制最终文件及用户素材，最后生成 ZIP 交付包。

查看原文
references/state-and-pitfalls.md:40来自说明文档打开原文件
- Create `.stitch/` directory at project start.- Write `metadata.json` after every state-changing operation (project creation, design system creation, screen generation, edit, variant selection, approval).- **Status flow:** `interview` --> `designing` --> `approved` --> `delivered`- If `metadata.json` exists when the skill starts:
SKILL.md:236来自说明文档打开原文件
1. Identify the latest approved versions in `.stitch/designs/` (highest `desktop-vN.html`, and `mobile-vN.html` if mobile was generated). Copy them into the bundle root, renaming desktop to `index.html` and mobile to `mobile.html`. Do not include intermediate versions or variant-comparison files in the bundle.2. Generate `color-tokens.json` with primary color, colorMode, colorVariant, fonts, roundness.3. Copy `.stitch/DESIGN.md`.4. Collect user assets from `.stitch/user-assets/` if any exist.5. Generate `DEPLOY.md` using the template in `references/state-and-pitfalls.md`.6. Create the zip: `zip -r "{project-name}-landing-page.zip" "{project-name}-landing-page/"`7. Tell the user: "Bundle is ready at `{path}`. See `DEPLOY.md` for the deployment checklist."

API 密钥仅被要求通过环境变量或 `.env` 提供；指令明确禁止显示、转录或回显密钥。

查看原文
SKILL.md:33来自说明文档打开原文件
2. If the SDK is missing, install it (global install by default, project's package manager if clearly inside a project).3. Verify the API key env var (as named in the docs) is set. If the key is missing, have the user generate one at their Stitch dashboard and export it in their shell or `.env`.4. Make one minimal SDK call to confirm auth. Diagnose and retry once on failure before involving the user.Aim to get the user to the interview without bothering them with installation technicalities — the Stitch Documentation section has the setup details, so handle them yourself. Never display, transcribe, or echo the key.
从这里开始 · 工作说明SKILL.md
brand-landingpage
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。 另有 1 个章节，可在原文件中查看。

文件引用关系图

4 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录4 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • references/interview-framework.md已纳入全文
  • references/state-and-pitfalls.md已纳入全文
  • references/stitch-architecture.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
  • references/interview-framework.md配套文件
  • references/state-and-pitfalls.md配套文件
  • references/stitch-architecture.md配套文件

代码和说明中提到的操作

读取密钥或账号配置
SKILL.md:33来自说明文档打开原文件
2. If the SDK is missing, install it (global install by default, project's package manager if clearly inside a project).3. Verify the API key env var (as named in the docs) is set. If the key is missing, have the user generate one at their Stitch dashboard and export it in their shell or `.env`.4. Make one minimal SDK call to confirm auth. Diagnose and retry once on failure before involving the user.
读取文件
SKILL.md:48来自说明文档打开原文件
Read these files at the indicated moments. Do not re-read them on every iteration.
连接外部网站
SKILL.md:248来自说明文档打开原文件
- Stitch SDK usage and installation documentation: `https://stitch-design.ai/docs/sdk/ai-sdk`- DESIGN.md documentation and examples: `https://stitch-design.ai/docs/design-md/overview`
SKILL.md:249来自说明文档打开原文件
- Stitch SDK usage and installation documentation: `https://stitch-design.ai/docs/sdk/ai-sdk`- DESIGN.md documentation and examples: `https://stitch-design.ai/docs/design-md/overview`
读取了多少行
841
文件校验值（用于核对版本）
fcadacc82bbdb46cb315ace096cf5dc767c7517839bbe9bb14d680518a4f7e91