The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze data from external design files (.pen). This creates an attack surface where a malicious file could contain embedded instructions intended to influence the agent's subsequent actions or the batch_design operations mentioned in the instructions.
Ingestion points: The filePath parameter in the get_variables tool allows the agent to read external files.
Boundary markers: The instructions do not define specific delimiters or validation checks for the content retrieved from the files.
Capability inventory: The skill uses the tool output to inform future design operations, potentially carrying over malicious context.
Sanitization: There are no instructions for the agent to sanitize or validate the design tokens before using them.
[COMMAND_EXECUTION]: The skill provides a tool (get_variables) that accepts a filePath parameter. While intended for design files, an agent could be manipulated into attempting to read sensitive system files (e.g., configuration or credential files) if the underlying MCP tool implementation does not enforce strict path validation or sandboxing.
[PROMPT_INJECTION]: The skill uses high-urgency formatting and keywords such as "CRITICAL PREREQUISITE" and "IMPORTANT" to control the agent's behavior and intent recognition. While these are used here for scoping and safety, such emphatic patterns are often associated with instructions that attempt to override system-level constraints.

pencil-mcp-get-variables