Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Pencil design workflow helper, with some opinionated defaults that may affect generated UI language and style but no evidence of hidden persistence, credential access, exfiltration, or unsafe execution.
Install this if you want an opinionated Pencil UI design assistant. Be aware that it defaults generated UI copy to Simplified Chinese and can mutate Pencil documents through MCP tools, so specify your desired language, style, target files, and whether existing design nodes may be edited or deleted.
This rule forces Simplified Chinese as the default for all user-facing text unless the user explicitly overrides it, which overrides likely user intent and can silently alter deliverables. In an auto-triggered skill, that behavior is especially risky because it can cause unauthorized language conversion in generated files and code artifacts without informed consent.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
| [`codegen-workflow.md`](references/codegen-workflow.md) | Full design-to-code workflow |
| [`codegen-mapping.md`](references/codegen-mapping.md) | Tailwind / shadcn quick mapping tables |
> **Output rule**: user-facing design files must always be saved as `<name>.pen` (never `.pen.json` — that suffix is reserved for skill-internal storage).
---
The repeated guidance in the 'Common Mistakes' section reinforces a mandatory Simplified Chinese output default, making the unsafe behavior more likely to be followed consistently. Repetition in operational guidance increases the chance that agents will apply language coercion even when the surrounding task context suggests another language or no translation at all.
The trigger scope is excessively broad, activating on generic UI prototyping, design-system, design-to-code, and Pencil tool usage requests. Over-broad activation can cause the skill to intercept unrelated tasks and impose its own workflow, increasing the chance of unintended file modifications, user-friction, or policy-conflicting behavior in contexts where this skill was not explicitly requested.
The instruction mandates Inter for all text and explicitly says not PingFang SC, which is a language/locale-related constraint expressed in natural language. The file does not offer a user choice or explain a justified regional/compliance reason for excluding the alternate font.
The markdown includes a concrete UI text example with the label "确认", which imposes a specific language in natural-language content. The file does not indicate that the skill is China-specific or that language should be selected based on user preference, so this can conflict with language/locale choice policies.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
✓ Primary CTA always near-black `#181d26` (NEVER link blue) · one primary per viewport · whitespace is the hero atmosphere (no gradient/mesh/aurora) · signature cards in coral/forest/dark/cream for voltage moments · demo-grid heights deliberately uneven · pricing sub-system stays self-contained (Inter Display 475 + pill radius) · 96 px vertical rhythm on every editorial band · weight ladder stops at 500 (legal exception 600).
✗ **Don't make `#1b61c9` link blue the primary button** — it's the link color only · no hero gradient/aurora/mesh · no display type at weight 700 · no `pill` radius outside the pricing surface · no two consecutive white bands · no shadow language for cards (color-block first) · no extra accent colors beyond the documented signature palette · no inverted/translucent buttons on dark signature cards (white stays white).
The typography section hard-codes Apple-specific font families such as SF Pro Display and SF Pro Text, with only narrowly prescribed fallbacks, effectively forcing a specific locale/style presentation rather than offering user choice. Under the stated policy, prescriptive language or locale constraints without opt-in can be a natural-language policy violation unless clearly justified as region-specific.
The decision flow says User said "use <style>"? and otherwise to ask a follow-up, but it does not define the accepted style names, variants, or any exclusion examples at the trigger point. In a markdown skill-routing file, this can create ambiguity about when automatic routing should occur versus when clarification is required.