penpot-design-md
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Penpot design files, including component names, text strings, and token identifiers, which are then formatted into a markdown document. This creates an attack surface for indirect prompt injection where malicious content within a design file could attempt to influence the agent's behavior during the extraction process.\n
- Ingestion points: Design data is ingested through the execution of
scripts/extractDesignData.jsandscripts/sampleComponentStyles.js, which read page names, component names, and text characters from the Penpot canvas.\n - Boundary markers: The skill uses a structured markdown template (
references/04-designmd-template.md) to place design data into specific sections, though it lacks explicit "ignore instructions" delimiters around the sampled text content.\n - Capability inventory: The skill utilizes
execute_codeto query the Penpot API and writes the final documentation to the local filesystem.\n - Sanitization: Basic data normalization is performed, such as converting font sizes to standard units and quoting color hex codes in YAML frontmatter.\n- [DYNAMIC_EXECUTION]: The skill uses the
execute_codetool to run local JavaScript snippets within the Penpot plugin environment to retrieve file data.\n - Evidence: Found in the usage of
scripts/extractDesignData.jsandscripts/sampleComponentStyles.js.\n - The scripts are static templates used to perform read-only operations on the Penpot API and do not involve dynamic code generation from untrusted network sources.
Audit Metadata