stitch-loop

An agent skill by google-labs-code, from google-labs-code/stitch-skills. Tags: automation, developer-tools, multi-agent, stitch, web.

What it does

Teaches agents to iteratively build websites using Stitch with an autonomous baton-passing loop pattern

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add google-labs-code/stitch-skills --skill stitch-loop

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/google-labs-code/stitch-skills
cp -r stitch-skills/plugins/stitch-utilities/skills/stitch-loop ~/.claude/skills/stitch-loop

Safety box score

Grade C, moderate risk: 28 of 100 risk points, rated 2026-10-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is an autonomous website-building loop that reads a baton file, generates pages with Stitch, moves the resulting HTML into `site/public/`, and rewrites project docs for the next iteration. The main risks are repeated unattended changes to the site tree, external network calls to Stitch for generation/downloads, and local shell execution for previewing pages.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It can run local shell commands via Bash, including the example `npx serve site/public` to start a dev server; there is no shipped script evaluation or `eval`.
Network access	2 (moderate)	It relies on remote Stitch MCP tools and explicitly downloads generated assets from `htmlCode.downloadUrl` and `screenshot.downloadUrl`, so page content leaves the machine and comes back from an external service.
Filesystem reach	2 (moderate)	It reads and writes multiple project files (`.stitch/next-prompt.md`, `.stitch/SITE.md`, `.stitch/metadata.json`) and moves generated output into `site/public/{page}.html`, which can overwrite site content and navigation.
Secrets & credentials	0 (none)	The skill does not mention tokens, passwords, keychains, `.env` files, or browser sessions.
Privilege & persistence	0 (none)	No sudo, global system changes, services, scheduled tasks, or shell startup edits are required by the skill.
Instruction hijack surface	0 (none)	There is no hidden text or instruction to ignore safeguards; the prompt pressure is about workflow, not prompt injection.
Irreversible actions	2 (moderate)	The core purpose is an iterative autonomous loop that generates a page, integrates it, updates the sitemap, and writes the next baton (`"You MUST update `.stitch/next-prompt.md` before completing your work to continue the loop."`).
Transparency	1 (low)	The final HTML and screenshots are produced at runtime from remote Stitch URLs, so the reviewer cannot inspect the actual generated page content from the repo alone.

Before installing

Read `.stitch/SITE.md` and `SKILL.md` together so you know which files it will rewrite.
Check whether you are comfortable with it writing into `site/public/` and updating `.stitch/next-prompt.md` every run.
If you will use it, try one iteration in a throwaway branch or scratch copy of the repo first.
Confirm the Stitch MCP server is trusted, since the skill sends prompts and downloads generated assets from it.

Rated 2026-10-21 by an automated review of 6 files from the skill's repository.

Source

Repository: google-labs-code/stitch-skills (all skills from this repository)
Path: plugins/stitch-utilities/skills/stitch-loop/SKILL.md
Branch: main
Collection: stitch-utilities
Updated: 2026-09-19

cli-developer — Use when building CLI tools, implementing argument parsing, or adding interactive prompts.
deploy-to-vercel — Deploy applications and websites to Vercel.
dev-browser — Browser automation with persistent named pages via the dev-browser CLI.
hyperframes — Mandatory entry point: read this first for any request to make, create, edit, animate, or render a video, animation, or motion graphic, including a promo.
hyperframes-registry — Search, install, and wire registry blocks and components into HyperFrames compositions.
latent-briefing — This skill should be used when the user asks to "share memory between agents", "KV cache compaction for multi-agent", "orchestrator worker context".