ui-color-palette-penpot
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the active Penpot environment, which constitutes an attack surface for indirect prompt injection.\n
- Ingestion points: Data is extracted from the designers' canvas via
penpot.selectionand from the document's local library viapenpot.library.local.colorsin thereferences/extract-source-colors.mdandreferences/extract-styles-colors.mdfiles.\n - Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions for the ingested design data, although the processing is limited to specific color properties.\n
- Capability inventory: The skill possesses the ability to execute JavaScript via the
execute_codetool and perform network/API operations through MCP tools to create and modify tokens and styles.\n - Sanitization: The extraction logic performs basic validation by filtering for 'solid' fill types and normalizing hex strings to RGB values, which provides a layer of sanitization for the ingested data.\n- [DYNAMIC_EXECUTION]: The skill utilizes the
execute_codetool to run JavaScript snippets against the Penpot plugin API for data extraction.\n - Evidence: The reference implementation files for color extraction provide static JS code blocks that recurse through Penpot frames to collect fill colors. This is the standard mechanism for interacting with the Penpot design context and is scoped to internal data processing.
Audit Metadata