{ "$schema": "https://bestaiskill.com/schemas/agent-install/2.json", "skill": "stitch-skills", "built": "2026-10-26", "control_level": 5, "control_level_label": "L5 严管", "capabilities": [ "terms_compliance", "execute_command", "install_deps", "network", "write_file" ], "required_controls": { "agent": [ "isolated_environment", "per_use_authorization" ], "admin": [ "strict_authorization", "full_audit", "compliance_signoff" ] }, "evidence": [ { "file": "SKILL.md", "summary": "Touches areas strictly regulated by compliance and platform Terms of Service" }, { "file": "scripts/", "summary": "Executes local scripts or commands: `bash scripts/fetch-stitch.sh` to download HTML/screenshots (instruction locations: react-components/SKILL.md and r" }, { "file": "scripts/ 或 SKILL.md", "summary": "Declares dynamic installation of external language package dependencies" }, { "file": "网络端点", "summary": "Declares external network access: curl fetches signed URLs returned by MCP (domain belongs to Google Cloud Storage): the curl command in fetch-stitch.sh; re" }, { "file": "本地工作目录", "summary": "File read/write and artifact output: writes .stitch/designs/{page}.html and .png (two commands in fetch-stitch.sh)." } ], "verification": { "method": "第一遍：只读通读全库 78 个文件中的关键面（三份 plugin.json 与 .codex-plugin 变体、.agents/plugins/marketplace.json、16 个 SKILL.md 的 frontmatter 与流程段、10 个可执行脚本、resources/references/examples，以及 README/CONTRIBUTING/SECURITY 与 CI workflow），逐条按 file+line+逐字 quote 取证。第二遍独立复核（换角度找茬）：①重读 marketplace 与三份插件清单，重新论证 skill 路径选择；②对每条 external_deps 二次 grep 调用点（curl / python3 / npx tsx / npm / shadcn / design.md / remotion）；③安全侧独立扫 credential 与写入路径，并专门读 snapshot.ts 的 auth-script 分支与 upload_to_stitch.py 的 key 处理；④对照 README 的插件表与目录结构图清点技能数，找宣称与磁盘的差；⑤复核 pin。", "second_pass": [ { "item": "skill.path 的选取", "status": "ok", "detail": "重读 .agents/plugins/marketplace.json 与三个 plugin.json：仓库根与 plugins/ 直属层都没有 SKILL.md 或 manifest，故条目只能落在插件级或插件内的具体技能上。根 README 与 marketplace 都把它当『库』对待（displayName=Stitch Skills、三条 source.path），而 brief 要求 official_desc 取 SKILL.md frontmatter 原文——plugins/stitch-design 本身没有 SKILL.md，故选其中承载设计主流程的入口技能目录 plugins/stitch-design/skills/generate-design（name: stitch::generate-design，frontmatter 有完整 description）。" }, { "item": "official_desc 逐字与折行", "status": "ok", "detail": "重读 generate-design/SKILL.md L1-9：description 用 YAML 折叠符 `>-`，跨 5 行；已按折叠后单行逐字收录，未改动用词。另注意 plugins/stitch-design/plugin.json 的插件级 description 与 .codex-plugin/plugin.json 的文案不同（前者用破折号、后者更短），属两处清单不一致，非本 skill 的 description。" }, { "item": "external_deps：Stitch REST 端点与请求头", "status": "ok", "detail": "重读 upload_to_stitch.py：默认 base 为 https://stitch.googleapis.com，URL 拼接为 `{api_url}/v1/projects/{project_id}/screens:batchCreate`，请求头 `X-Goog-Api-Key` 与 `--api-key required=True` 均在位；三处行号与首遍一致。" }, { "item": "external_deps：curl 调用点与两处重复脚本", "status": "ok", "detail": "对 plugins 全量二次检索 curl：react-components 与 react-native 的 fetch-stitch.sh 是同一语句的两个副本，remotion 的 download-stitch-asset.sh 额外做 mkdir -p 与失败 rm -f。三处均为极简包装，不读凭证。" }, { "item": "security.credential_reads 的三条配置路径", "status": "ok", "detail": "重读 upload-to-stitch/SKILL.md 的『Get the API Key』段：Antigravity / Gemini CLI / Claude Code 三条配置路径、X-Goog-Api-Key 取值说明、找不到时必须向用户索要的强约束，以及脚本调用处的 `--api-key `，逐字与首遍一致。" }, { "item": "security：任意模块执行分支", "status": "ok", "detail": "重读 snapshot.ts 的 auth-script 分支：打印 Running authentication script from 后 `path.resolve(process.cwd(), opts.authScript)` 再 `await import(authPath)`，若导出为函数则以 page 调用。确认这是无校验的本地模块执行入口，参数由调用方（agent）填入。" }, { "item": "security：SSL 处理是否属安全降级", "status": "ok", "detail": "重读 upload_to_stitch.py 的 ssl 相关行与 SKILL.md 的 Troubleshooting 段：脚本用 certifi 提供的 CA 建默认上下文，SKILL.md 建议通过 SSL_CERT_FILE 指定 CA——是修正缺失根证书，不是 disable verification；故未把它计入降级行为。" }, { "item": "security.file_writes 的路径清单", "status": "ok", "detail": "重读 react-components/SKILL.md 与 stitch-loop/SKILL.md 的写入段：.stitch/designs、.stitch/metadata.json、resources/style-guide.json 覆盖写、site/public 迁移、.stitch/next-prompt.md 强制更新均有原文；另补 post_process.ts 与 snapshot.ts 的脚本级写入。写入目标全部位于当前项目或技能自身目录。" }, { "item": "宣称 vs 实际：README 的插件与技能表", "status": "discrepancy", "detail": "重读 README 的 utilities 表与目录结构图并对照磁盘：README 只列 4 个 utility，而 plugins/stitch-utilities/skills/ 实为 5 个（多出 site-md）；README 还宣称每个 skill 都有 scripts/resources/examples，实测 code-to-design、react-vite-dashboard、site-md、design-md、enhance-prompt 等仅 SKILL.md（至多另有 README.md）。" }, { "item": "任务书设想的 mcp__stitch__* 工具名", "status": "discrepancy", "detail": "全仓检索 mcp__ 零命中；实际用占位符 [prefix]:（react-components）、示例 mcp_stitch: / stitch: / remotion:，以及 taste-design frontmatter 里的裸名 StitchMCP。故不能按 mcp__stitch__* 描述其调用面。" }, { "item": "脚本是否真的被调起（verify-setup.sh）", "status": "discrepancy", "detail": "全仓检索 verify-setup：仅 shadcn-ui/README.md 的目录树提到一次，SKILL.md 无任何执行指令——随包发货但当前无调用点，属未接线资产。" }, { "item": "pin 与许可证", "status": "ok", "detail": "工作副本 HEAD = 0337446dadde6f8c94210444e2aa9d546126480f，与任务书 pin 0337446dadde 一致；LICENSE 为 Apache-2.0（LICENSE L1-L2），三个 plugin.json 的 license 字段同。" } ], "level": 2, "level_label": "V2 已复核", "commit": "0337446dadde6f8c94210444e2aa9d546126480f", "sha256": "88df56fdbec37bb5dbe40de8fdd18b5908d78fe23bcd32a195f14a4e2db4f1cf", "reviewed_by": "skills-bayx-audit", "reviewed_at": "2026-10-25" }, "assessed_at": "2026-10-25", "method_version": "2.0", "mirror": { "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/stitch-skills.tar.gz", "sha256": "88df56fdbec37bb5dbe40de8fdd18b5908d78fe23bcd32a195f14a4e2db4f1cf", "commit": "0337446dadde6f8c94210444e2aa9d546126480f" }, "original": { "github": "https://github.com/google-labs-code/stitch-skills/tree/main/plugins/stitch-design/skills/generate-design", "path": "plugins/stitch-design/skills/generate-design", "commit": "0337446dadde6f8c94210444e2aa9d546126480f" } }