Most static alerts are false positives from Markdown code spans around file names, Stitch tool names, and documentation links. Confirmed issues are limited to host-affecting actions: opening HTML with OS commands, creating a zip through zip -r, and checking an API key environment variable. No prompt injection attempt or data exfiltration intent was found.
3. Verify the API key env var (as named in the docs) is set. If the key is missing, have the user ge
Line 33 instructs the agent to verify an API key environment variable and references .env setup. It says not to echo the key, but the workflow still touches secret-bearing configuration.
The skill instructs the agent to install the Stitch SDK if missing, with global install as the default. Automatic global package installation can modify the host environment and execute package lifecycle scripts.
Line 32 explicitly says to install the SDK and prefer a global install by default. The setup purpose is legitimate, so this is a host-modification risk rather than evidence of malicious intent.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
6. **Open the saved HTML file in the user's browser** so they can see the design at full fidelity. U
Line 168 explicitly permits Windows browser launch through cmd /c start. That uses a command shell and can be risky if any local path is not validated or quoted correctly.
6. **Open the saved HTML file in the user's browser** so they can see the design at full fidelity. U
Line 168 instructs the agent to run OS-specific commands such as open, xdg-open, or start to launch a local HTML file. This is legitimate preview behavior, but it still executes host commands and requires path validation.
6. Create the zip: `zip -r "{project-name}-landing-page.zip" "{project-name}-landing-page/"`
Line 241 tells the agent to invoke zip -r to create the delivery bundle. The placeholders are quoted, but this is still external command execution using a project-derived name.
Most static alerts are false positives from Markdown code spans around file names, Stitch tool names, and documentation links. Confirmed issues are limited to host-affecting actions: opening HTML with OS commands, creating a zip through zip -r, and checking an API key environment variable. No prompt injection attempt or data exfiltration intent was found.
3. Verify the API key env var (as named in the docs) is set. If the key is missing, have the user ge
Line 33 instructs the agent to verify an API key environment variable and references .env setup. It says not to echo the key, but the workflow still touches secret-bearing configuration.
The skill instructs the agent to install the Stitch SDK if missing, with global install as the default. Automatic global package installation can modify the host environment and execute package lifecycle scripts.
Line 32 explicitly says to install the SDK and prefer a global install by default. The setup purpose is legitimate, so this is a host-modification risk rather than evidence of malicious intent.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
6. **Open the saved HTML file in the user's browser** so they can see the design at full fidelity. U
Line 168 explicitly permits Windows browser launch through cmd /c start. That uses a command shell and can be risky if any local path is not validated or quoted correctly.
6. **Open the saved HTML file in the user's browser** so they can see the design at full fidelity. U
Line 168 instructs the agent to run OS-specific commands such as open, xdg-open, or start to launch a local HTML file. This is legitimate preview behavior, but it still executes host commands and requires path validation.
6. Create the zip: `zip -r "{project-name}-landing-page.zip" "{project-name}-landing-page/"`
Line 241 tells the agent to invoke zip -r to create the delivery bundle. The placeholders are quoted, but this is still external command execution using a project-derived name.
Static analysis reported many high-severity patterns, but review found most were Markdown false positives from backticked terms, color hex values, and examples. The confirmed risks are legitimate workflow actions: installing or using the Stitch SDK, checking an API key environment variable, making external Stitch calls, writing project files, opening local HTML in a browser, and creating a zip bundle.
The skill instructs the agent to verify SDK installation, make a minimal authenticated SDK call, and rely on Stitch documentation and generated download URLs. This is expected for the skill, but it requires third-party network access and should be disclosed to users.
The workflow clearly depends on an external SDK, documentation, authentication check, and generated download URLs. No evidence shows credential exfiltration, so the risk is operational rather than malicious.
The skill tells the agent to verify that the Stitch API key environment variable is set and to help the user export it if missing. It also instructs the agent not to display or echo the key, which reduces but does not remove secret-handling risk.
The file explicitly references checking an API key environment variable and user export flow. The same section includes a protective instruction not to echo the key, so this is a managed medium risk.
Filesystem Writes, Browser Opening, and Zip Creation
The skill writes state, generated HTML, user-provided assets, design documentation, and deployment bundles. It also opens saved HTML through OS browser commands and creates a zip archive, which are legitimate delivery steps but can affect the local workspace.
The documented workflow intentionally creates and copies files, opens local HTML, and runs zip packaging. These actions are scoped to generated project artifacts and do not show malicious intent.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Markdown Backtick Command Alerts Are Mostly False Positives
Many external command findings come from Markdown inline code, code fences, tool names, enum names, and template examples. They describe the workflow and API shapes rather than executable code embedded in the skill.
The cited lines are Markdown documentation and examples, not script files or runtime code. The only real command usage is separately captured in the medium findings.
Weak Cryptography Alerts Are Color and Identifier False Positives
The weak-cryptography alerts map to color hex values, typography names, state fields, and design-system identifiers. No evidence found of cryptographic operations or weak crypto algorithms being used.
The cited context is color mapping and metadata schema content. There is no hashing, encryption, signing, or password-storage logic in these files.
The C2 and Windows SAM alerts appear to be substring matches inside harmless design documentation. No evidence found of command-and-control behavior, system database access, or credential dumping intent.
The referenced lines are color rows or a workflow diagram line. They do not contain code, URLs for control servers, or operating-system credential paths.
All 295 static analysis findings were evaluated against actual file content. All 'weak cryptographic algorithm' findings are false positives caused by hex color codes in brand design reference tables. All 'Ruby/shell backtick execution' findings are false positives from markdown code blocks showing SDK method names and CLI commands. The 'C2 keywords', 'system reconnaissance', 'Windows SAM database', and 'Windows cmd.exe' findings are all false positives resulting from design terminology, brand interview questions, and legitimate file-opening instructions. The 'environment file access' finding is confirmed but represents proper API key management with documented security practices. The 'hardcoded URL' findings are low-severity documentation links for the Stitch SDK. The heuristic 'dangerous combination' finding is a false positive reflecting expected SDK integration patterns (API key + SDK calls + documentation references). No prompt injection, data exfiltration, or malicious intent was detected.
4
Files scanned
841
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
SKILL.md contains hardcoded URLs pointing to Stitch SDK documentation. These are legitimate documentation links but represent external network references in the skill instructions.
Static analysis flagged 295 potential issues but all are false positives or legitimate usage patterns. The 100+ 'weak cryptographic algorithm' findings are color hex values in design documentation misidentified as crypto hashes. The 142 'shell backtick execution' findings are markdown code block delimiters. The critical heuristic finding for 'dangerous combination' is dismissed: the skill checks for an API key env var (legitimate for Stitch integration), references documentation URLs, and uses markdown code fences. No prompt injection or malicious intent detected. Risk level is low.
4
Files scanned
841
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
SKILL.md instructs the AI to verify an API key environment variable is set for the Stitch service. This is legitimate and expected for a skill that uses an external design API. The skill explicitly states 'Never display, transcribe, or echo the key' as a safeguard.
SKILL.md references two documentation URLs for the Stitch SDK. These are legitimate reference links, not data exfiltration endpoints. No credential data is sent to these URLs.