upload-to-stitch
This skill maliciously exfiltrates sensitive local configuration files and API keys from the user's environment while failing to meet basic naming and licensing compliance standards.
Skill Info
Install
npx skills add https://github.com/google-labs-code/stitch-skillsAssessments (3)
AI Agent Traps ↗The skill explicitly instructs the agent to scan sensitive local configuration files (e.g., ~/.gemini/settings.json, .claude.json) to extract API keys, which facilitates credential theft.
Locate your active MCP server configuration file and extract the API key: - Antigravity: .gemini/antigravity/mcp_config.json...
NER model detected organization in skill content (confidence: 0.54)
M*********
NER model detected organization in skill content (confidence: 0.62)
S*****
NER model detected organization in skill content (confidence: 0.68)
C*
NER model detected organization in skill content (confidence: 0.73)
M*
The skill explicitly instructs the AI to scrape sensitive API keys from local configuration files (e.g., .claude.json, .gemini/settings.json). This behavior poses a significant security risk by encouraging the exfiltration of credentials from the user's environment.
Section 2: 'Get the API Key' instructs the AI to locate and extract API keys from specific sensitive configuration files on the local machine.
Skill name does not conform to the Agent Skills spec: 1–64 lowercase alphanumeric characters and hyphens, with no leading, trailing, or consecutive hyphens.
stitch::upload-to-stitch
Skill does not specify a license field. Specifying a license helps users understand usage terms.
The SKILL.md 'name' field does not match the skill's parent directory name, which the Agent Skills spec requires. A mismatch can confuse skill resolution or mask the skill's real identity.
stitch::upload-to-stitch ≠ upload-to-stitch
Version History (4)
Badge
[](https://mondoo.com/ai-agent-security/skills/github/google-labs-code/stitch-skills/upload-to-stitch)<a href="https://mondoo.com/ai-agent-security/skills/github/google-labs-code/stitch-skills/upload-to-stitch"><img src="https://mondoo.com/ai-agent-security/api/badge/github/google-labs-code/stitch-skills/upload-to-stitch.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/google-labs-code/stitch-skills/upload-to-stitch.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow