100Critical
This skill is malicious as it explicitly instructs the agent to scan and exfiltrate sensitive local configuration files and API keys from the user's home directory.
HygienePackaging & Manifest3 findings
Skill Info
Namegoogle-labs-code/stitch-skills/upload-to-stitch
Registrygithub
Version0337446dadde
PURLpkg:github/google-labs-code/stitch-skills@0337446dadde?skill=upload-to-stitch
Stars8,116
Installs6,300
Source
SHA-256e8ddf11677a9...
SHA-1cb0540e5c0c9...
MD5290b6e87fe16...
TLSHfb81b9375bcb...
ssdeep96:ZEY/4TTFS...
Size4,200 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
6,300 installs
Skills.shDocs
npx skills add https://github.com/google-labs-code/stitch-skillsAssessments (3)
AI Agent Traps ↗Credential harvesting instructionscriticalcredential theftAML.T0055AML.T0037LLM02:2025
The skill explicitly instructs the agent to scan sensitive local configuration files (e.g., ~/.gemini/settings.json, ~/.claude.json) to extract API keys, facilitating potential credential exfiltration.
90% confidence
Locate your active MCP server configuration file and extract the API key: ... ~/.gemini/settings.json ... ~/.claude.json
Credential harvesting instructionshighcredential theftAML.T0055AML.T0037LLM02:2025
The skill explicitly instructs the agent to scan sensitive local configuration files (e.g., ~/.claude.json, ~/.gemini/settings.json) to extract API keys, which facilitates credential exfiltration. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
90% confidence
Locate your active MCP server configuration file and extract the API key: ... ~/.claude.json
Organization name detectedmediumpii exposureAML.T0024LLM02:2025
NER model detected organization in skill content (confidence: 0.54)
54% confidence
M*********
Organization name detectedmediumpii exposureAML.T0024LLM02:2025
NER model detected organization in skill content (confidence: 0.62)
62% confidence
S*****
Organization name detectedmediumpii exposureAML.T0024LLM02:2025
NER model detected organization in skill content (confidence: 0.73)
73% confidence
M*
Description Mismatchcriticaldescription mismatchAML.T0011.000LLM06:2025LLM09:2025
The skill explicitly instructs the AI to perform credential harvesting by reading sensitive configuration files from the user's home directory to obtain API keys.
85% confidence
Section 2: 'Locate your active MCP server configuration file and extract the API key... .gemini/antigravity/mcp_config.json... ~/.gemini/settings.json... ~/.claude.json'
Invalid skill name formatlowpolicy violation
Skill name does not conform to the Agent Skills spec: 1–64 lowercase alphanumeric characters and hyphens, with no leading, trailing, or consecutive hyphens.
100% confidence
stitch::upload-to-stitch
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Skill name does not match directoryinfopolicy violation
The SKILL.md 'name' field does not match the skill's parent directory name, which the Agent Skills spec requires. A mismatch can confuse skill resolution or mask the skill's real identity.
100% confidence
stitch::upload-to-stitch ≠ upload-to-stitch
Version History (4)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/google-labs-code/stitch-skills/upload-to-stitch)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/google-labs-code/stitch-skills/upload-to-stitch"><img src="https://mondoo.com/ai-agent-security/api/badge/github/google-labs-code/stitch-skills/upload-to-stitch.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/google-labs-code/stitch-skills/upload-to-stitch.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow