Skills stitch-loop

📦

stitch-loop

Name: stitch-loop
Author: google-labs-code

Content revision r1 Safe ⚙️ External commands🌐 Network access

Build Stitch Websites Iteratively

Large website builds often lose context between pages and iterations. This skill gives Claude, Codex, and Claude Code a baton workflow for generating, integrating, and continuing Stitch-based site work.

Supports: Claude Codex Code(CC)

🥉 78 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "stitch-loop" from https://skillstore.io/skills/google-labs-code-stitch-loop.md and its manifest at https://skillstore.io/api/skills/google-labs-code-stitch-loop/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/google-labs-code-stitch-loop.md Signed manifest GET /api/skills/google-labs-code-stitch-loop/manifest Signed lockfile GET /api/skills/google-labs-code-stitch-loop/lockfile

Test it

Using "stitch-loop". Build the contact page from the current baton.

Expected outcome:

The agent generates a contact page, places it in the public site folder, updates the sitemap, and prepares a new baton for the next page.

Using "stitch-loop". Continue the site after the roadmap is empty.

Expected outcome:

The agent selects a brand-aligned idea from the creative guidelines, builds the page, removes the consumed idea, and writes the next task.

Using "stitch-loop". Check whether the generated page matches the Stitch screenshot.

Expected outcome:

The agent previews the local page, compares layout and visual differences, reports any mismatches, and applies practical corrections.

Security Audit

Safe

v6 • 7/9/2026 Open versioned report

Most static findings are false positives caused by Markdown backticks around filenames, MCP tool names, and example content. One finding is confirmed: the skill asks agents to run a local server through Bash using npx, which is a legitimate preview step but still executes an external command.

Files scanned

526

Lines analyzed

Review items

False positives ignored

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:111-112

Ruby/shell backtick execution

2. **Start dev server**: Use Bash to start a local server (e.g., `npx serve site/public`)

This line instructs the agent to use Bash to start a local development server with npx serve. That is legitimate for previewing local output, but it still executes an external package command and should require user trust.

Risk Factors

⚙️ External commands (50)

resources/site-template.md:28-29 resources/site-template.md:29 resources/site-template.md:35-36 resources/site-template.md:36-58 resources/site-template.md:58-59 resources/site-template.md:59-63 resources/site-template.md:63-65 SKILL.md:19 SKILL.md:29 SKILL.md:30 SKILL.md:37 SKILL.md:39-52 SKILL.md:52-55 SKILL.md:55-56 SKILL.md:56-63 SKILL.md:63-64 SKILL.md:64-73 SKILL.md:73-74 SKILL.md:74-85 SKILL.md:85-87 SKILL.md:87 SKILL.md:88 SKILL.md:89-90 SKILL.md:90-91 SKILL.md:91-92 SKILL.md:92 SKILL.md:93-94 SKILL.md:94 SKILL.md:95 SKILL.md:99 SKILL.md:102-110 SKILL.md:110 SKILL.md:111-112 SKILL.md:112 SKILL.md:113-114 SKILL.md:114-121 SKILL.md:121-122 SKILL.md:122-128 SKILL.md:128-131 SKILL.md:131-136 SKILL.md:136-149 SKILL.md:149-153 SKILL.md:153-165 SKILL.md:165-173 SKILL.md:173-182 SKILL.md:182-184 SKILL.md:184 SKILL.md:190-193 SKILL.md:193-194 SKILL.md:194-202

🌐 Network access (1)

SKILL.md:112

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/google-labs-code-stitch-loop/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/google-labs-code-stitch-loop/security.svg)](https://skillstore.io/skills/google-labs-code-stitch-loop?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/google-labs-code-stitch-loop?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/google-labs-code-stitch-loop/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/google-labs-code-stitch-loop.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

google-labs-code. (2026). stitch-loop security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/google-labs-code-stitch-loop/audits/6

BibTeX citation

@techreport{google-labs-code-google-labs-code-stitch-loop-2026,
  author = {google-labs-code},
  title = {stitch-loop security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/google-labs-code-stitch-loop/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "stitch-loop security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "google-labs-code"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/google-labs-code-stitch-loop/audits/6"
identifiers:
  - type: other
    value: "skillstore:google-labs-code-stitch-loop:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Expand a marketing site

Generate one new page at a time while keeping the sitemap and design direction synchronized.

Prototype a product website

Turn a roadmap of page ideas into Stitch-generated static pages across repeated agent runs.

Maintain design consistency

Reuse a DESIGN.md block in every baton prompt so new pages follow the same visual system.

Try These Prompts

Run the next Stitch iteration

Read next-prompt.md, generate the requested page with Stitch, integrate it into the site, and prepare the next baton.

Create the first baton

Review SITE.md and DESIGN.md, choose the highest priority page, and write a valid next-prompt.md for the next Stitch generation step.

Verify a generated page

Integrate the generated page, start a local preview if approved, compare the rendered page with the Stitch screenshot, and fix visible differences.

Continue an autonomous build loop

Complete the current baton task, update SITE.md, remove consumed ideas, and write a specific next-prompt.md that keeps the site roadmap moving.

Best Practices

Keep SITE.md current before every run so the agent does not recreate existing pages.
Copy the design system block into each baton prompt for consistent Stitch output.
Review generated HTML and screenshots before publishing pages beyond the local site.

Avoid

Do not leave next-prompt.md empty after an iteration unless you want the loop to stop.
Do not use vague page prompts that omit structure, device type, or design guidance.
Do not approve external commands or network downloads without understanding the source.