stitch::upload-to-stitch
An agent skill by google-labs-code, from google-labs-code/stitch-skills.
What it does
Upload local assets (images, mockups, extracted HTML, design markdown) to a Stitch project. ALWAYS use this skill when you need to upload visual assets, HTML pages, or design docs to Stitch, particularly when direct MCP tool calls fail or truncate due to base64 token limits.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add google-labs-code/stitch-skills --skill 'stitch::upload-to-stitch'Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/google-labs-code/stitch-skills
cp -r stitch-skills/plugins/stitch-design/skills/upload-to-stitch ~/.claude/skills/'stitch::upload-to-stitch'Safety box score
Grade C, moderate risk: 39 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill uploads local images, HTML, and markdown to a remote Stitch project by running a bundled Python script. The main risks are that it reads API credentials from home-directory config files and transmits the chosen file plus the API key over HTTP to Stitch.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It explicitly runs the bundled script via Bash: `python3 <SKILL_DIR>/scripts/upload_to_stitch.py`, which reads files and performs the upload. |
| Network access | 2 (moderate) | The script makes outbound HTTP requests to Stitch, including `urllib.request.urlopen(req, **urlopen_kwargs)` with `X-Goog-Api-Key` and the file payload. |
| Filesystem reach | 2 (moderate) | It reads local files and instructs the agent to inspect home dotfiles for credentials, including `~/.gemini/settings.json` and `~/.claude.json`. |
| Secrets & credentials | 2 (moderate) | The skill requires extracting an API key from local MCP config files and sends it as `X-Goog-Api-Key`, so it touches account credentials. |
| Privilege & persistence | 0 (none) | There is no sudo, service registration, global install, or shell/profile modification in the skill or script. |
| Instruction hijack surface | 0 (none) | No hidden prompts or instructions to ignore safeguards are present; the script and SKILL.md are straightforward and do not request policy bypass. |
| Irreversible actions | 2 (moderate) | Its purpose is to upload local content to a remote Stitch project, and the script even sets `create_screen_instances=True`, but it requires user confirmation before running. |
| Transparency | 0 (none) | The shipped files are plain text and fully readable; there are no binaries, decoded blobs, or downloaded installers. |
Before installing
- Read `SKILL.md` and confirm you are comfortable with it reading `~/.gemini/*` or `~/.claude.json` for an API key.
- Inspect `scripts/upload_to_stitch.py` and verify the only network destination you want is `https://stitch.googleapis.com` (or your chosen `--api-url`).
- Test in a throwaway Stitch project with a non-sensitive file first.
- Have the agent show the exact file path, size, and type before it runs the upload script.
Rated 2026-10-19 by an automated review of 2 files from the skill's repository.
Source
- Repository
- google-labs-code/stitch-skills (all skills from this repository)
- Path
- plugins/stitch-design/skills/upload-to-stitch/SKILL.md
- Branch
- main
- Collection
- stitch-design
- Updated
- 2026-09-19
Related skills
- stitch::code-to-design — Convert frontend code (Vite, React, Angular, Vue, etc.) to a Stitch Design by chaining static HTML extraction, design system extraction.
- stitch::extract-design-md — Extract a comprehensive design system (DESIGN.md) directly from frontend source code — React, Vue, Svelte, Angular, plain HTML/CSS.
- stitch::extract-static-html — Extract self-contained static HTML from a built web application or React components by inlining CSS and images.
- stitch::generate-design — Generate new screens from text prompts or images, edit existing screens with prompts and design system tokens, and generate design variants using Stitch MCP.
- stitch::manage-design-system — Manage design systems in Stitch using MCP tools. Includes retrieval of assets, creating/updating design systems in Stitch, and applying them to screens.
- design-md — Analyze Stitch projects and synthesize a semantic design system into DESIGN.md files