The Agent Skills Directory

[SAFE]: No malicious prompt injection or behavior override instructions were found. The skill follows standard instructional practices for design migration.- [SAFE]: Data handling is localized to the migration context. Access to Figma data is handled via the Figma MCP or user-provided input, and writes to Penpot are restricted to the plugin API. No evidence of credential theft or unauthorized exfiltration was detected.- [SAFE]: The skill uses clear, unobfuscated JavaScript and Markdown. No Base64-encoded payloads, zero-width characters, or homoglyph substitutions were identified in any of the files.- [SAFE]: Remote code execution is not present. The scripts are intended for local execution within the Penpot environment and do not fetch external dependencies or execute untrusted remote scripts.- [SAFE]: The skill implements a secure migration pattern by normalizing external data into an IR before performing any write operations, which acts as a validation layer against malformed or malicious input data.

penpot-migrate