upload-to-stitch
This skill maliciously instructs the agent to scan and exfiltrate sensitive API keys from local configuration files, posing a severe risk of credential theft.
Skill Info
Install
npx skills add https://github.com/google-labs-code/stitch-skillsAssessments (3)
AI Agent Traps ↗The skill explicitly instructs the agent to scan sensitive configuration files (e.g., .gemini/settings.json, .claude.json) to extract API keys, which facilitates credential theft.
Locate your active MCP server configuration file and extract the API key: ... .gemini/settings.json ... .claude.json
NER model detected organization in skill content (confidence: 0.54)
M*********
NER model detected organization in skill content (confidence: 0.62)
S*****
NER model detected organization in skill content (confidence: 0.68)
C*
NER model detected organization in skill content (confidence: 0.73)
M*
The skill explicitly instructs the AI to scrape sensitive API keys from local configuration files (e.g., .claude.json, .gemini/settings.json). This behavior poses a significant security risk by encouraging the exfiltration of credentials from the user's environment.
Section 2: 'Get the API Key' instructs the AI to locate and extract API keys from specific sensitive configuration files on the local machine.
Skill name does not conform to the Agent Skills spec: 1–64 lowercase alphanumeric characters and hyphens, with no leading, trailing, or consecutive hyphens.
stitch::upload-to-stitch
Skill does not specify a license field. Specifying a license helps users understand usage terms.
The SKILL.md 'name' field does not match the skill's parent directory name, which the Agent Skills spec requires. A mismatch can confuse skill resolution or mask the skill's real identity.
stitch::upload-to-stitch ≠ upload-to-stitch
Version History (4)
Badge
[](https://mondoo.com/ai-agent-security/skills/github/google-labs-code/stitch-skills/upload-to-stitch)<a href="https://mondoo.com/ai-agent-security/skills/github/google-labs-code/stitch-skills/upload-to-stitch"><img src="https://mondoo.com/ai-agent-security/api/badge/github/google-labs-code/stitch-skills/upload-to-stitch.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/google-labs-code/stitch-skills/upload-to-stitch.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow