skills/anis-dr/skills/pen-dev/Gen Agent Trust Hub

pen-dev

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external design briefs and evidence to construct prompts for a secondary designer agent.
  • Ingestion points: The agent reads designs/brief.md and results from the Mobbin MCP search_screens tool (references/designer-iteration.md).
  • Boundary markers: The skill uses 'HARD RULE' instructions to constrain the designer sub-agent, but does not employ strict delimiters to isolate untrusted input from the brief or evidence.
  • Capability inventory: The skill utilizes shell execution (pen, git, cp, open, sips), file system writes, and MCP tool calls (SKILL.md, references/designer-iteration.md).
  • Sanitization: There are no explicit steps to sanitize or validate the content of the design brief or Mobbin search results before interpolation.
  • [DYNAMIC_EXECUTION]: The skill requires the agent to generate and execute local scripts based on provided logic.
  • The agent is instructed to create snapshot-tree.sh and diff-tree.sh in designs/scripts/ to perform JSON tree hashing and comparison (references/gated-runs.md).
  • Python and JavaScript snippets are provided for token migration and semantic auditing of the .pen JSON files (references/token-migration.md).
  • [COMMAND_EXECUTION]: The skill relies on various shell commands for its core functionality.
  • Interacts with the pen CLI for design tasks and pen interactive for flushing app changes.
  • Uses standard utilities like git, cp, open, sips (for image cropping), magick/compare (for pixel diffing), and awk (SKILL.md, references/gated-runs.md).
  • [EXTERNAL_DOWNLOADS]: The skill references external resources and installation of additional tools.
  • Recommends the installation of the higgsfield-generate skill from higgsfield-ai/skills (references/designer-iteration.md).
  • Fetches design evidence and screenshot comparisons from external sources like Mobbin and Google Fonts (via the Export tool).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 05:47 AM