pencil-design-skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 3.2.0

Overview

This skill is a disclosed Pencil design workflow helper, with some opinionated defaults that may affect generated UI language and style but no evidence of hidden persistence, credential access, exfiltration, or unsafe execution.

Install this if you want an opinionated Pencil UI design assistant. Be aware that it defaults generated UI copy to Simplified Chinese and can mutate Pencil documents through MCP tools, so specify your desired language, style, target files, and whether existing design nodes may be edited or deleted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: This rule forces Simplified Chinese as the default for all user-facing text unless the user explicitly overrides it, which overrides likely user intent and can silently alter deliverables. In an auto-triggered skill, that behavior is especially risky because it can cause unauthorized language conversion in generated files and code artifacts without informed consent.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

| [`codegen-workflow.md`](references/codegen-workflow.md) | Full design-to-code workflow |
| [`codegen-mapping.md`](references/codegen-mapping.md) | Tailwind / shadcn quick mapping tables |

> **Output rule**: user-facing design files must always be saved as `<name>.pen` (never `.pen.json` — that suffix is reserved for skill-internal storage).

---

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Natural-Language Policy Violations

High

• Confidence: 96% confidence
• Finding: The repeated guidance in the 'Common Mistakes' section reinforces a mandatory Simplified Chinese output default, making the unsafe behavior more likely to be followed consistently. Repetition in operational guidance increases the chance that agents will apply language coercion even when the surrounding task context suggests another language or no translation at all.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger scope is excessively broad, activating on generic UI prototyping, design-system, design-to-code, and Pencil tool usage requests. Over-broad activation can cause the skill to intercept unrelated tasks and impose its own workflow, increasing the chance of unintended file modifications, user-friction, or policy-conflicting behavior in contexts where this skill was not explicitly requested.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The instruction mandates `Inter` for all text and explicitly says `not PingFang SC`, which is a language/locale-related constraint expressed in natural language. The file does not offer a user choice or explain a justified regional/compliance reason for excluding the alternate font.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The markdown includes a concrete UI text example with the label "确认", which imposes a specific language in natural-language content. The file does not indicate that the skill is China-specific or that language should be selected based on user preference, so this can conflict with language/locale choice policies.

Scope Creep

Low

• Category: Excessive Agency

Content

✓ Primary CTA always near-black `#181d26` (NEVER link blue) · one primary per viewport · whitespace is the hero atmosphere (no gradient/mesh/aurora) · signature cards in coral/forest/dark/cream for voltage moments · demo-grid heights deliberately uneven · pricing sub-system stays self-contained (Inter Display 475 + pill radius) · 96 px vertical rhythm on every editorial band · weight ladder stops at 500 (legal exception 600).

✗ **Don't make `#1b61c9` link blue the primary button** — it's the link color only · no hero gradient/aurora/mesh · no display type at weight 700 · no `pill` radius outside the pricing surface · no two consecutive white bands · no shadow language for cards (color-block first) · no extra accent colors beyond the documented signature palette · no inverted/translucent buttons on dark signature cards (white stays white).

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The typography section hard-codes Apple-specific font families such as SF Pro Display and SF Pro Text, with only narrowly prescribed fallbacks, effectively forcing a specific locale/style presentation rather than offering user choice. Under the stated policy, prescriptive language or locale constraints without opt-in can be a natural-language policy violation unless clearly justified as region-specific.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: The decision flow says `User said "use <style>"?` and otherwise to ask a follow-up, but it does not define the accepted style names, variants, or any exclusion examples at the trigger point. In a markdown skill-routing file, this can create ambiguity about when automatic routing should occur versus when clarification is required.

Static analysis

No suspicious patterns detected.