Security audit

Design Tool

Security checks for vulnerabilities and agentic risk

Overview

This package is labeled as Penpot but actually describes and ships a broad local logging tool that can retain user-provided text on disk.

Review this carefully before installing. It does not appear to provide Penpot integration; it is a local command-line logger. Avoid entering secrets, tokens, private project details, or sensitive client information unless you are comfortable with that text being retained in ~/.local/share/design-tool and later shown through history or search.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to be Penpot, an open-source collaborative design tool, but the documented behavior is a generic local logging utility that records arbitrary user input, stores persistent history, supports search, and exports accumulated data. This mismatch is dangerous because users or orchestrators may invoke the skill under false assumptions, causing unintended collection and retention of sensitive content entered during unrelated tasks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manifest presents a design/prototyping collaboration skill, but the file content describes a local command-line recorder with persistent logs and history. Security-wise, deceptive packaging increases the chance that the skill is selected in contexts where users may supply sensitive project notes or operational data, which are then silently retained on disk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script’s behavior does not match the declared Penpot/design-collaboration purpose at all; instead it acts as a generic persistence and retrieval utility for arbitrary user-provided text. That mismatch is dangerous because users may grant trust or provide sensitive design/project content under false pretenses, while the tool quietly stores and later exposes that content through search/export features.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill exposes very broad verb-based commands such as run, check, analyze, generate, export, config, and status, which overlap with common natural-language intents and other tools. In an agent environment, this raises the risk of accidental invocation or routing, causing unrelated user content to be logged, searched, or exported without the user intending to use this skill.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The skill persistently stores arbitrary inputs in per-command logs and a unified history file under the user's home directory, and can export that data into additional files. Even without network exfiltration, session persistence creates privacy and confidentiality risk because sensitive prompts, design notes, filenames, or embedded secrets may remain on disk and become accessible to other local processes or future sessions.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
All data is stored locally in `~/.local/share/design-tool/`: - **Per-command logs** — Each command (run, check, convert, etc.) writes to its own `.log` file with pipe-delimited `timestamp|value` format. - **history.log** — A unified activity log recording every write operation with timestamps. - **Export formats** — The `export` utility function supports JSON, CSV, and TXT output, written to `~/.local/share/design-tool/export.<fmt>`. No external services, databases, or API keys are required. Everything is flat-file and human-readable.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The inline comments present the script as a legitimate design-tool utility, but the actual implementation is only a command logger that persists arbitrary input. Misleading documentation increases the chance that operators or users will trust the tool and enter sensitive information they would not otherwise provide.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Across many commands, the tool accumulates arbitrary user input into per-command logs and provides built-in mechanisms to search, display recent entries, and export all collected data in bulk. In a skill context, this creates a straightforward exfiltration channel for natural-language secrets or sensitive business content, especially because the functionality is unrelated to the claimed Penpot purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: User-supplied input is written verbatim into persistent log files under the user’s home directory without notice, consent, redaction, or retention limits. This creates a privacy and secrets-handling risk because prompts, tokens, file paths, proprietary content, or other sensitive text may be retained and later read by other local processes or users with filesystem access.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.