penpot-rest-ops

Overview

This skill lets an agent perform Penpot design-tool operations by calling the RPC API directly with curl — no SDK, no pip dependency. Penpot's API is a command RPC: every operation is a POST to <base_url>/api/rpc/command/<command-name> with a JSON body, authenticated with a personal access token. The agent consumes the credentials the caller injected, finds a command in a bundled OpenAPI spec via a command index + a $ref-resolver, constructs the curl, and parses the JSON. It covers the feasible design-seam surface — files, projects, teams, profile — and deliberately excludes rich canvas authoring (the update-file "changes" format), which is an internal, transit-encoded surface unfit for a general client.

When to activate

• ✅ Creating / getting / renaming / deleting / duplicating a Penpot design file.
• ✅ Listing or creating projects; listing teams; listing files in a project.
• ✅ Verifying an injected token works (get-profile whoami) or reading account/team/project metadata.

Do NOT activate when:

• You need to author canvas content (add/modify shapes, frames, tokens) inside a file — that is the update-file "changes" surface, which is out of scope (see Anti-patterns).
• You only need credential setup — credentials are provided by the caller; this skill does not provision or resolve them (see references/credentials.md for the contract it consumes).
• The target is the editor-bound Penpot MCP rather than the headless REST/RPC API.

Workflow