taste-penpot

SUSPICIOUS. The design purpose is mostly coherent, but the core Penpot integration is internally inconsistent with safe provenance: it rejects Penpot's official MCP and requires a third-party server that receives Penpot tokens and workspace data. With explicit install steps, credential forwarding, and transitive tool installation, the skill's footprint is broader and riskier than necessary for a design skill.