Install
$ agentstack add skill-google-labs-code-stitch-skills-upload-to-stitch ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Upload-to-Stitch
Upload local assets (images, mockups, HTML, and markdown files) to a Stitch project using the provided upload script, which bypasses the MCP tool's base64 output token limits.
> [!NOTE] > The AI model cannot upload files via MCP tools directly because the base64 > encoding of even a small file exceeds the model's output token limit (~16K > tokens). This script reads the file and sends it directly over HTTP.
Steps
1. Identify Target Project
Use list_projects to find the correct projectId.
2. Get the API Key
Locate your active MCP server configuration file and extract the API key:
- Antigravity:
.gemini/antigravity/mcp_config.jsonor.gemini/jetski/mcp_config.json - Gemini CLI:
~/.gemini/settings.jsonor~/.gemini/extensions/Stitch/gemini-extension.json - Claude Code:
~/.claude.json
Extract:
- API Key: From the
X-Goog-Api-Keyheader or auth argument - MCP URL (optional): From the
httpUrlor endpoint argument (defaults to
https://stitch.googleapis.com)
> [!IMPORTANT] > If you cannot find the API key in any of these locations, or if you cannot access these files, you MUST ask the user to provide the Stitch API key. Do not proceed without a valid API key.
3. Run Upload Script
> [!WARNING] > Checkpoint — User Confirmation Required. > Before running the upload script, you MUST pause and present the file(s) > to be uploaded (paths, sizes, and types) to the user and wait for explicit > approval. Do NOT execute the upload script until the user confirms.
Use run_command to execute the Python script:
python3 /scripts/upload_to_stitch.py \
--project-id \
--file-path \
--api-key \
[--api-url ] \
[--title ] \
[--generated-by ]
> [!TIP] > macOS / SSL Certificate Troubleshooting: > If the upload fails with ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] unable to get local issuer certificate, this means your Python installation does not have root certificate authorities configured. > > The script automatically attempts to use the certifi package to load the CA bundle if it is installed in your python environment. If certifi is not installed, you can either install it (pip install certifi) or manually supply the SSL_CERT_FILE environment variable when running the script: > ``bash > SSL_CERT_FILE=$(python3 -c "import certifi; print(certifi.where())") python3 /scripts/upload_to_stitch.py \ > --project-id \ > --file-path \ > --api-key \ > [--api-url ] \ > [--title ] \ > [--generated-by ] > ``
Supported File Types
| Extension | MIME Type | |:---|:---| | .png | image/png | | .jpg, .jpeg | image/jpeg | | .webp | image/webp | | .html, .htm | text/html | | .md | text/markdown |
The script auto-detects MIME type from the file extension.
Script Options
--project-id: Required. The Stitch project ID.--file-path: Required. Path to the local file to upload.--api-key: Required. API key for Stitch authorization.--api-url: Optional. Base URL of the Stitch API. Defaults tohttps://stitch.googleapis.com.--title: Optional. Title for the uploaded screen.--generated-by: Optional. Specify how the uploaded file was generated (e.g., 'stitch::extract-static-html' skill, 'Claude Code', 'Codex', 'Gemini' etc.).
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: google-labs-code
- Source: google-labs-code/stitch-skills
- License: Apache-2.0
- Homepage: https://stitch.withgoogle.com/docs/mcp/setup
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.