penpot-audit-tokens
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external design files, creating a potential surface for indirect prompt injection.
- Ingestion points: The collectStyleUsage.js script reads shape properties (fills, strokes, spacing, tokens) from the Penpot design environment via the current page root.
- Boundary markers: No explicit delimiters or instructions are present to ensure that data extracted from design shapes is treated as untrusted content by the agent.
- Capability inventory: The skill has the capability to modify the design via shape.applyToken calls as defined in SKILL.md and detection logic.
- Sanitization: The scripts do not perform explicit validation or sanitization of property values before incorporating them into the markdown report.
Audit Metadata