pencil-mcp-get-variables
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary function is to call the
get_variablestool to read design tokens, which aligns with its description and name. - [SAFE]: No evidence of prompt injection, data exfiltration, or obfuscated code was found. The skill explicitly instructs the agent to verify user intent, requiring a specific mention of "Pencil" before execution, which is a defensive measure against accidental tool misuse.
- [SAFE]: The tool parameter
filePathis used correctly in examples to point to design-specific file extensions (.pen). No sensitive system paths or credentials are exposed or targeted.
Audit Metadata