Find bugs in the Stitch SDK using a real API key. Covers standard functional edges and tricky situations.
52
57%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Passed
No findings from the security scan
Fix and improve this skill with Tessl
tessl review fix ./.agents/skills/stitch-sdk-bug-bash/SKILL.mdThis skill provides a framework and instructions for finding bugs in the Stitch SDK using a real API key. It guides you through exploring standard functional edge cases and tricky situations beyond the golden path.
When using this skill, do not just verify that the SDK works. Try to break it!
Stitch)STITCH_API_KEY is present.StitchToolClient and verify that the first call fails with a clear authentication or connection error, not a generic noise error.Project)stitch.project('invalid-id') does not throw (lazy instantiation) but the first call on it fails safely.project.listScreens() do.Screen)Project.generate() are correctly populated on the returned Screen instances without a second fetch.undefined or empty arrays rather than crashing on null property access!DesignSystem)project.designSystem('ds-id') correctly receives the projectId and injects it into calls like ds.apply(...).| Scenario | What to try | Expected Behavior |
|---|---|---|
| Stale Handles | Create a screen, delete the project, then try to edit the screen handle. | Clean API error indicating resource not found, wrapped in StitchError. |
| Empty Prompts | Call project.generate('') or with only whitespace. | Safe rejection or clear API error, no crash in codegen. |
| Projections on null | Force an API call that returns a response without the expected projection field (if you can simulate or find such a tool fallback case). | The SDK should use optional chaining (e.g., raw?.prop) and return undefined rather than throwing TypeError: cannot read property of undefined. |
| Massive arrays | Pass hundreds of screen IDs to ds.apply(). | Check if it hits payload limits gracefully or fails with a clear message. |
try/catch.error.code or error.name to see if it's a StitchError or a generic raw error.TypeError or "cannot read property of undefined", that is a HIGH PRIORITY BUG in the SDK's projection logic!Use this template to run a quick end-to-end bash session.
import { stitch } from "@google/stitch-sdk";
async function bash() {
const apiKey = process.env.STITCH_API_KEY;
if (!apiKey) throw new Error("STITCH_API_KEY is required");
console.log("🚀 Starting Bug Bash...");
let project;
try {
// 1. Create a fresh project
project = await stitch.createProject({
displayName: `Bug Bash ${new Date().toISOString()}`,
});
console.log(`✓ Created Project: ${project.id}`);
// 2. Try to break generate with empty prompt
try {
await project.generate({ prompt: "" });
console.log("✗ BUG: Generate with empty prompt should have failed!");
} catch (e) {
console.log("✓ Generate with empty prompt failed safely as expected.");
}
// 3. Create a design system
const ds = await project.createDesignSystem({
name: "Bash Style",
variables: { primaryColor: "#ff0000" },
});
console.log(`✓ Created Design System: ${ds.id}`);
// 4. List screens (should be empty)
const screens = await project.listScreens();
console.log(`✓ Listed screens: found ${screens.length}`);
// 5. Apply design system to empty list
try {
await ds.apply({ selectedScreenIds: [] });
console.log("✓ Applied design system to empty list (handled).");
} catch (e) {
console.log("✗ Did applying to empty list fail? Inspect error.");
}
} catch (error) {
console.error("💥 Bash failed with error:", error);
} finally {
// 6. Cleanup
if (project) {
console.log(`🧹 Cleaning up project ${project.id}...`);
// Assuming we have a deleteProject binding or we just leave it if not available
// await project.delete();
}
}
}
bash();575a9fb
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.