stitch::manage-design-system
An agent skill by google-labs-code, from google-labs-code/stitch-skills. Tags: assets, automation, design, documents, mcp.
What it does
Manage design systems in Stitch using MCP tools. Includes retrieval of assets, creating/updating design systems in Stitch, and applying them to screens.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add google-labs-code/stitch-skills --skill 'stitch::manage-design-system'Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/google-labs-code/stitch-skills
cp -r stitch-skills/plugins/stitch-design/skills/manage-design-system ~/.claude/skills/'stitch::manage-design-system'Safety box score
Grade D, elevated risk: 47 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill manages Stitch design systems: it looks up projects/screens, fetches remote assets, writes `.stitch/DESIGN.md` and metadata locally, and can upload/apply a design system back to Stitch. The main risks are remote mutation of a project, network access to Stitch APIs, and execution of an external Python uploader script that is not included in the reviewed files.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It explicitly allows `Bash` and tells the agent to run `python3 .../upload_to_stitch.py`, so it can execute native code during the workflow. |
| Network access | 2 (moderate) | It uses MCP retrieval tools (`list_projects`, `list_screens`, `get_screen`, `read_url_content`) and uploads to Stitch's `/v1/projects/{projectId}/screens:batchCreate`, so data leaves the machine. |
| Filesystem reach | 1 (low) | It writes `.stitch/DESIGN.md` and `.stitch/metadata.json` in the workspace, but does not describe broader filesystem access. |
| Secrets & credentials | 2 (moderate) | The upload command requires `--api-key <API_KEY>`, so the workflow expects access to a Stitch credential. |
| Privilege & persistence | 0 (none) | There is no sudo, service registration, shell profile editing, or other elevated-system action described. |
| Instruction hijack surface | 1 (low) | `SKILL.md` says to "Refer to your system prompt" for tool-prefix handling, which depends on hidden prompt conventions, though it does not instruct the agent to ignore safeguards. |
| Irreversible actions | 2 (moderate) | It can create/update a design system and apply it to screens in a remote project; the upload step is gated by user confirmation, but the action is still mutative. |
| Transparency | 2 (moderate) | The main upload path is delegated to an external Python script and another plugin (`design-md`/`stitch-utilities`) that are not included in the reviewed files, so the exact code path is not fully inspectable. |
Before installing
- Inspect the referenced uploader script source before trusting it, especially the `python3 .../upload_to_stitch.py` path.
- Try the workflow in a throwaway Stitch project first and verify the remote changes are limited to the intended design system.
- Confirm you are comfortable granting the skill your Stitch API key and remote project access.
- Check that you only want local writes under `.stitch/DESIGN.md` and `.stitch/metadata.json` in your workspace.
Rated 2026-10-20 by an automated review of 3 files from the skill's repository.
Source
- Repository
- google-labs-code/stitch-skills (all skills from this repository)
- Path
- plugins/stitch-design/skills/manage-design-system/SKILL.md
- Branch
- main
- Collection
- stitch-design
- Updated
- 2026-09-19
Related skills
- stitch::extract-static-html — Extract self-contained static HTML from a built web application or React components by inlining CSS and images.
- hyperframes-core — The HyperFrames composition contract — build one renderable project.
- stitch::code-to-design — Convert frontend code (Vite, React, Angular, Vue, etc.) to a Stitch Design by chaining static HTML extraction, design system extraction.
- design-md — Analyze Stitch projects and synthesize a semantic design system into DESIGN.md files
- agents-connect — Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.
- chrome-mcp-troubleshooting — Diagnose and fix Claude in Chrome MCP extension connectivity issues.