penpot-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Penpot files and comments which represents a potential attack surface for indirect instructions.\n
- Ingestion points: Data retrieved via
penpot get-fileand visual rendering of external pages atpenpot.e9n.devusing Playwright (SKILL.md).\n - Boundary markers: The instructions lack explicit delimiters or warnings for the agent to ignore instructions embedded in the design data.\n
- Capability inventory: The skill utilizes tools for file modification (
penpot_page), browser automation (Playwright), and local filesystem operations (rm) (SKILL.md).\n - Sanitization: No sanitization or validation of the external content is described before processing.\n- [EXTERNAL_DOWNLOADS]: The skill references an external domain used for design rendering and review.\n
- Evidence:
https://penpot.e9n.dev(SKILL.md). This domain is associated with the author's infrastructure.
Audit Metadata