The Agent Skills Directory

[COMMAND_EXECUTION]: The skill leverages the execute_code tool to run local JavaScript analysis scripts, such as scanSlopProbes.js and slopScore.js. These scripts are used to inspect the Penpot design tree and calculate a quality score. All actions that modify the design (in 'treat' mode) are explicitly defined as 'Apply-with-review', ensuring a human-in-the-loop checkpoint before any changes are finalized.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data originating from Penpot design files, including layer names and text content. It implements a robust defensive workflow to mitigate injection risks: it first runs deterministic probes to gather tree data, followed by a 'describe-then-judge' protocol. This forces the model to document factual, neutral descriptions of the design (Pass A) before performing any qualitative assessment (Pass B), reducing the likelihood of being influenced by adversarial content within the design itself.
[DYNAMIC_EXECUTION]: The skill uses dynamic regular expression generation within scanSlopProbes.js to identify buzzwords and placeholders from a versioned list. This is a local data-processing operation used for content detection and does not involve executing untrusted code or remote payloads.

penpot-anti-slop