·
Last changedVersion:
This version passed the hardening gate. Hardening applied 10 targeted changes, removed allowed-tools entries that grant unscoped shell access or are not valid tool patterns, and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 1. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 7. Review findings remaining: 12.
2
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
README.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Closed |
2 findings
You are an autonomous frontend builder participating in an iterative site-building loop. Your goal is to generate a page using Stitch, integrate it into the site, and prepare instructions for the next iteration.
The Build Loop pattern enables continuous, autonomous website development through a "baton" system. Each iteration:
.stitch/next-prompt.md)Required:
.stitch/DESIGN.md file (generate one using the design-md skill if needed).stitch/SITE.md file documenting the site vision and roadmapOptional:
The .stitch/next-prompt.md file acts as a relay baton between iterations:
Critical rules:
page field in YAML frontmatter determines the output filename.stitch/DESIGN.mdParse .stitch/next-prompt.md to extract:
page frontmatter fieldBefore generating, read these files:
| File | Purpose |
|---|---|
| Site vision, Stitch Project ID, existing pages (sitemap), roadmap |
| Required visual style for Stitch prompts |
Important checks:
Use the Stitch MCP tools to generate the page:
list_tools to find the Stitch MCP prefix.stitch/metadata.json exists, use the projectId from it[prefix]:create_project, then call [prefix]:get_project to retrieve full project details, and save them to .stitch/metadata.json (see schema below)[prefix]:get_project again and update the screens map in .stitch/metadata.json with each screen's full metadata (id, sourceScreen, dimensions, canvas position)[prefix]:generate_screen_from_text with:
projectId: The project IDprompt: The full prompt from the baton (including design system block)deviceType: DESKTOP (or as specified).stitch/designs/{page}.html and .stitch/designs/{page}.png already exist:
htmlCode.downloadUrl — Download and save as .stitch/designs/{page}.htmlscreenshot.downloadUrl — Append =w{width} to the URL before downloading, where {width} is the width value from the screen metadata (Google CDN serves low-res thumbnails by default). Save as .stitch/designs/{page}.png.stitch/designs/{page}.html to site/public/{page}.htmlhref="#") and wire them to the new pageIf the Chrome DevTools MCP Server is available, verify the generated page:
list_tools to see if chrome* tools are present[chrome_prefix]:navigate to open http://localhost:3000/{page}.html[chrome_prefix]:screenshot to capture the rendered page.stitch/designs/{page}.png) for fidelityModify .stitch/SITE.md:
[x]You MUST update .stitch/next-prompt.md before completing.
.stitch/SITE.md Section 5 (Roadmap) for pending items.stitch/metadata.json SchemaThis file persists all Stitch identifiers so future iterations can reference them for edits or variants. Populate it by calling [prefix]:get_project after creating a project or generating screens.
| Field | Description |
|---|---|
| Full resource name ( |
| Stitch project ID (from |
| Human-readable project title |
| Design system tokens: color mode, font, roundness, custom color, saturation |
| Target device: |
| Map of page name → screen object. Each screen includes |
| User's role on the project ( |
The loop can be driven by different orchestration layers:
| Method | How it works |
|---|---|
Human-in-loop | Developer reviews each iteration before continuing |
Manual | Developer runs the agent repeatedly with the same repo |
The skill is orchestration-agnostic — focus on the pattern, not the trigger mechanism.
This skill works best with the design-md skill:
.stitch/DESIGN.md using the design-md skill from an existing Stitch screen.stitch/next-prompt.md (breaks the loop).stitch/DESIGN.md in the prompthref="#") instead of wiring real navigation.stitch/metadata.json after creating a new project| Issue | Solution |
|---|---|
Stitch generation fails | Check that the prompt includes the design system block |
Inconsistent styles | Ensure |
Loop stalls | Verify |
Navigation broken | Check all internal links use correct relative paths |
Get started with chainctlchainctl skill install public/google-labs-code/stitch-loop:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/google-labs-code/plugins/stitch-utilities/skills/stitch-loop:latest
Apache-2.0
HARDENING.md
LICENSE
README.md
SKILL.md
examples/SITE.md
examples/next-prompt.md
resources/baton-schema.md
resources/site-template.md