stitchflow-216ddf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited stitchflow-216ddf (Plugin) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn product briefs into Google Stitch projects, UI directions, design systems, HTML handoff artifacts, screenshots, and regression evidence from one portable agent workflow.
StitchFlow is for teams that want Stitch to stay the design source of truth while agents handle the repeatable work around it: prompt shaping, variants, DESIGN.md, design-system application, local exports, audits, and release checks.
StitchFlow live workflow demo
Copilot, Gemini CLI, and clients that understand SKILL.md / AGENTS.md.
client exposes them; otherwise use the bundled stitch-starter toolkit.
result.json,variants.json, export manifests, and audit reports under runs/.
DESIGN.md, create/list/update/applyStitch design systems, and regression-test the full design-system path.
responsive overflow, browser errors, and serious accessibility issues.
to short local paths when long Stitch screen titles hit filesystem limits.
>=22STITCH_API_KEYSecrets stay local. The installer preserves an existing toolkit .env, and the toolkit .gitignore excludes .env, runs/, and node_modules/.
git clone https://github.com/yshishenya/stitchflow.git
cd stitchflow
bash install.sh --target allAdd your API key:
${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}/.envThen restart your agent client.
Canonical install paths:
| Item | Path |
|---|---|
| Skill | ${AGENT_SKILLS_HOME:-$HOME/.agents}/skills/stitchflow |
| Toolkit | ${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter} |
| Legacy alias | stitch-design-local |
In Codex:
Use $stitchflow to generate a premium desktop analytics dashboard for a product team, with a left sidebar, KPI cards, trend charts, and clean Tailwind-ready HTML.In Claude Code:
/stitchflow landing page for a design tool aimed at enterprise product teamsIn OpenClaw:
Use the stitchflow skill to explore three mobile-first UI directions for a checkout experience.Direct CLI:
cd "${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}"
npm run generate -- --prompt "A modern SaaS dashboard with sidebar and stat cards"
npm run variants -- --prompt "Explore three different visual directions" --variant-count 3
npm run edit -- --prompt "Make spacing calmer and strengthen the primary CTA"Outputs are written to:
${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}/runs/<timestamp>-<operation>-<slug>/When available, StitchFlow prefers native Stitch MCP tools such as create_project, generate_screen_from_text, edit_screens, generate_variants, upload_design_md, create_design_system_from_design_md, apply_design_system, and get_screen.
Codex MCP example:
[mcp_servers.stitch]
url = "https://stitch.googleapis.com/mcp"
enabled = true
[mcp_servers.stitch.http_headers]
"X-Goog-Api-Key" = "<your Stitch API key>"Restart the client after changing MCP config.
Run these from ${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}:
| Command | Purpose |
|---|---|
npm run tools | Inspect live Stitch MCP capabilities. |
npm run list | List projects and screens. |
npm run generate | Generate a new screen from text. |
npm run edit | Edit the latest or targeted screen. |
npm run variants | Generate screen variants. |
npm run design-md | Upload DESIGN.md and create a design system. |
npm run design-system | List/create/update/apply design systems. |
npm run export-screen | Export one screen as local evidence. |
npm run export-screens | Export an approved set of screen ids. |
npm run export-project | Export every project-listed screen. |
npm run download-project | Download code.html and referenced assets. |
npm run site-design-audit | Audit a completed website design handoff. |
npm run regression:e2e | Run the live StitchFlow regression. |
npm run site-design:e2e | Run the full live website design workflow. |
Useful examples:
npm run generate -- --prompt "A cinematic product homepage" --model-id GEMINI_3_1_PRO --timeout-ms 900000
npm run design-system -- --action apply --project-id 123 --asset-id 456 --screen-ids abc,def
npm run download-project -- --project-id 123
npm run download-project -- --project-id 123 --safe-download
npm run site-design-audit -- --file ./site-design-audit.json
npm run regression:e2e -- --timeout-ms 900000 --model-id GEMINI_3_FLASHSee Local CLI Usage for every flag and workflow boundary.
For full site work, StitchFlow does not jump from one generated homepage to implementation. The workflow is:
download-project.accessibility.
Start with Site Design Delivery.
Local static checks:
cd stitch-starter
npm ci
for script in scripts/*.mjs; do node --check "$script"; done
npm run site-design-audit -- --file /path/to/site-design-audit.json --check-project falseInstaller check:
bash install.sh --target all --skip-smoke --skip-npmLive release regression:
cd stitch-starter
npm run regression:e2e -- --timeout-ms 900000 --retries 1 --retry-delay-ms 3000 --model-id GEMINI_3_FLASHThe full site-design E2E is intentionally heavier. It uses a parent/worker wrapper so --total-timeout-ms can kill a stuck live worker process:
npm run site-design:e2e -- --brand "Turnirka" --timeout-ms 900000 --operation-timeout-ms 900000 --total-timeout-ms 3600000skills/stitchflow/SKILL.mdskills/stitch-design-local/SKILL.mdinstall.sh.github/plugin/plugin.jsongemini-extension.jsonStitchFlow uses semantic versioning. Backward-compatible feature additions are minor releases; backward-compatible fixes are patch releases; breaking workflow or CLI contract changes require a major release.
Every release should include:
regression:e2e evidenceRead CONTRIBUTING.md, open a focused pull request, and include validation evidence. Do not commit STITCH_API_KEY, .env, generated runs/, or node_modules/.
Apache-2.0. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.