openpencil-design
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill supports executing JavaScript code at runtime through the
op designcommand (e.g.,op design @ui.jsorop design '<js>' --script). While described as sandboxed, this provides a mechanism for dynamic code assembly and evaluation within the design workflow. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from untrusted external sources, creating an attack surface for indirect prompt injection.
- Ingestion points: Commands such as
op import:html <url>,op import:figma <file>, andop import:snapshot <file>ingest content from potentially attacker-controlled web pages and design files into the agent's context. - Boundary markers: The instructions do not define delimiters or specific instructions to ignore potential commands embedded within the imported design data.
- Capability inventory: The environment allows for file system writes (
op export,op save,op codegen:assemble), network access for importing content, and runtime script execution (op design --script). - Sanitization: There is no mention of sanitizing, filtering, or validating content retrieved from external URLs or imported files before it is processed by the agent.
Audit Metadata