penpot-build-screen
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
execute_codetool to run JavaScript snippets that interface with the Penpot plugin API. This is the intended functional mechanism for design automation, including board creation, layout configuration, and component instantiation. - [PERSISTENCE]: Project-specific state and progress are managed through the
setSharedPluginDataAPI to maintain a run ledger. This mechanism is used appropriately to track the incremental build process across multiple turns and does not exhibit malicious persistence patterns. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided design briefs which serve as an untrusted input surface. This is mitigated through a structured workflow requiring user approval of the planning phase and visual confirmation of each generated design section.
- Ingestion points: Design briefs are ingested during Phase 0 analysis.
- Boundary markers: The agent is instructed to confirm the interpreted brief, style profile, and section list with the user before performing any design mutations.
- Capability inventory: The skill has capabilities to create and modify design shapes, apply tokens, and fetch remote assets into the Penpot canvas via
uploadMediaUrl. - Sanitization: The skill relies on iterative human review and visual self-critique (Phase N+1) to validate the agent's output against the user's intent.
Audit Metadata