taste-penpot
Warn
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to dynamically download and install a third-party MCP server (@zcubekr/penpot-mcp-server) using npx and modify the local .cursor/mcp.json IDE configuration file. While the instructions mandate user consent, this workflow executes unverified code from an external registry and modifies the agent's environment.
- [COMMAND_EXECUTION]: The skill includes a helper script scripts/_skill_cli.py that provides a run_command function, which uses subprocess.run to execute arbitrary shell commands.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user inputs and project source code to generate design specifications and direct its internal PLAN -> ACT -> CRITIQUE workflow.
- Ingestion points: User design requests, marketing briefs, and existing application source code analyzed during the code-to-design phase.
- Boundary markers: Utilizes a structured workflow and explicit Ground rules to steer agent behavior.
- Capability inventory: Capable of writing files to the local directory, calling MCP tools for design board creation, and executing shell commands via provided scripts.
- Sanitization: No evidence of sanitization or validation of the ingested external content before it influences the agent's actions or tool parameters.
Audit Metadata