The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the Penpot design environment, specifically reading shape properties, text content, and layer structures via penpotUtils.shapeStructure and analyzeDescendants. This information is used to drive token creation and design updates. While this represents a potential surface for indirect prompt injection if a design file contains malicious content, the skill's operations are limited to the Penpot design library and shape properties, and it lacks external network exfiltration capabilities.
Ingestion points: scripts/inspectFileStructure.js, scripts/inferTokensFromShapes.js, and scripts/bindTokensToElements.js read properties directly from penpot.currentPage and penpot.library.local.
Boundary markers: The skill does not implement explicit delimiters for data read from the design, relying on programmatic property access in JavaScript.
Capability inventory: The skill utilizes penpot.library.local.tokens for management and shape.applyToken for design mutation. It does not perform network operations or access system-level files.
Sanitization: Scripts perform type checking (e.g., typeof s.borderRadius === 'number') and value validation before processing design data.

penpot-foundations