The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external .pen design files which may contain untrusted instructions.
Ingestion points: batch_get and get_editor_state in SKILL.md.
Boundary markers: The skill instructs the agent to use tool-based access rather than raw reading, but lacks explicit ignore-instruction delimiters for content.
Capability inventory: batch_design (file modification), set_variables, and get_screenshot.
Sanitization: No sanitization or validation of the design file content is specified.
[COMMAND_EXECUTION]: The batch_design tool interprets and executes an operations script string. While restricted to the Pencil design domain, this represents a dynamic execution vector if user input is interpolated.
[CREDENTIALS_UNSAFE]: The MCP server configuration example in SKILL.md includes an absolute file path (/Users/wandl/...) that exposes a local system username.

pencil