design-md

An agent skill by google-labs-code, from google-labs-code/stitch-skills. Tags: analysis, design, documentation, documents, stitch.

What it does

Analyze Stitch projects and synthesize a semantic design system into DESIGN.md files

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add google-labs-code/stitch-skills --skill design-md

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/google-labs-code/stitch-skills
cp -r stitch-skills/plugins/stitch-utilities/skills/design-md ~/.claude/skills/design-md

Safety box score

Grade B, low risk: 25 of 100 risk points, rated 2026-09-22. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill analyzes Stitch projects over remote MCP tools, downloads screen HTML and screenshots, and writes a `DESIGN.md` file in the project. Its main risks are outbound network access to Stitch/Google endpoints and the possibility of prompt injection from fetched project HTML or referenced remote guidance; otherwise it is mostly read-only aside from creating the output file.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No shell commands, scripts, or code evaluation are defined; the skill only uses MCP tools like `list_projects`, `get_screen`, `web_fetch`, and writes Markdown.
Network access	2 (moderate)	It actively calls Stitch MCP tools to list/fetch projects and screens and uses `web_fetch` to download HTML, screenshots, and the remote prompting guide, so project data and content leave the machine.
Filesystem reach	1 (low)	The intended output is `DESIGN.md` in the project directory, so the skill writes locally and could overwrite an existing file, but it does not target broader paths.
Secrets & credentials	0 (none)	The skill does not ask for passwords, API keys, `.env` files, browser sessions, or keychain data; it works on design metadata for owned Stitch projects.
Privilege & persistence	0 (none)	There is no sudo, global OS configuration, service registration, or shell startup modification required by the skill itself.
Instruction hijack surface	2 (moderate)	It instructs the agent to ingest fetched HTML and a remote prompting guide as reference material without any warning that those contents may contain hostile instructions, creating a prompt-injection surface.
Irreversible actions	0 (none)	The skill only synthesizes a documentation file; it does not publish, deploy, send messages, purchase, or delete anything.
Transparency	1 (low)	`README.md` installs via `npx skills add google-labs-code/stitch-skills --skill design-md --global`, which fetches from a registry and is not pinned to a specific commit, though the shipped files themselves are plain text.

Before installing

Read `README.md` and decide whether you want to trust the registry-based `npx skills add ... --global` install path.
Run it first in a scratch Stitch project so `DESIGN.md` can be overwritten safely.
Treat fetched HTML/screenshot content as untrusted input and inspect any prompt-like text before relying on it.
Confirm the skill only needs access to the intended Stitch account/project and no broader workspace data.

Rated 2026-09-22 by an automated review of 3 files from the skill's repository.

Source

Repository: google-labs-code/stitch-skills (all skills from this repository)
Path: plugins/stitch-utilities/skills/design-md/SKILL.md
Branch: main
Collection: stitch-utilities
Updated: 2026-09-19

site-md — Analyze a project description or site requirements and synthesize a project constitution into SITE.md for the Stitch Build Loop
taste-design — Semantic Design System Skill for Google Stitch.
stitch::extract-design-md — Extract a comprehensive design system (DESIGN.md) directly from frontend source code — React, Vue, Svelte, Angular, plain HTML/CSS.
domain-modeling — Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
meeting-minutes-taker — Transforms raw meeting transcripts into high-fidelity, structured meeting minutes (notes / summaries).
enhance-prompt — Transforms vague UI ideas into polished, Stitch-optimized prompts.