penpot-build-from-code
Warn
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill utilizes a workflow where the agent is instructed to populate local JavaScript templates (e.g.,
scripts/buildSection.jsandscripts/createScreenWrapper.js) with data extracted from untrusted user-provided code artifacts and then execute them. This pattern of dynamic script assembly and execution based on external input is a known risk vector for code injection if the input data is crafted to break out of the JavaScript literal structures within the template. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code artifacts (JSX, HTML, CSS) which may contain hidden instructions or malicious content designed to influence the agent's behavior during the translation process. The instructions lack explicit mechanisms to isolate or sanitize this data before processing it through the agent's logic.
- Ingestion points: User-provided code snippets (React, HTML, CSS, etc.) ingested during the discovery and transformation phases (SKILL.md).
- Boundary markers: The skill does not specify the use of delimiters or 'ignore' instructions for the untrusted code content.
- Capability inventory: The skill uses
execute_codeto interact with the Penpot API, create document elements, and manage state throughstorage.runandsetSharedPluginData(SKILL.md, scripts/buildSection.js). - Sanitization: No sanitization or validation steps are defined for the input code before it is parsed into the node specification used for script generation.
Audit Metadata