Security audit

Pencil Design

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real design-generation skill, but it normalizes running mutable npm/CDN content and replacing persistent agent skill instructions without strong pinning, integrity checks, or consent gates.

Install only if you are comfortable with Pencil/Claude-backed external AI processing your design prompts and selected design files. Prefer a pinned, project-local @pencil.dev/cli version, avoid npx pencil unless you know what it resolves to, review any downloaded SKILL.md before activation, and do not overwrite agent skill directories from @latest CDN URLs without verifying the source and contents.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:17
Finding: Ambiguous and Unpinned Package Resolution Can Execute an Untrusted Package
Content: View full analysis
Remediation: View remediation
/dev/null 2>&1 && pencil version ``` 3. If `npx` is needed only to invoke a locally installed dependency, prevent network installation: ```bash npx --no-install pencil version ``` 4. Install an exact, reviewed version of the scoped package: ```bash npm install --save-exact @pencil.dev/cli@ ``` 5. Prefer a project-local installation with a lockfile over a global installation. 6. Verify registry configuration, package provenance, integrity metadata, and signatures where supported. 7. Require explicit user approval before downloading or executing a package. ]]>

T08 · Insecure Dependencies

Error

Location: SKILL.md:76
Finding: Mutable Remote Skill Instructions Are Installed Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:114
Finding: User Prompts and Existing Design Content May Be Sent to External AI Services Without Explicit Consent
Content: View full analysis
--prompt "" --export --export-scale 2 ``` ```text Pass the user's request directly as the prompt — do not expand, or add detail beyond what the user actually said. ``` ```bash pencil --in design.pen --out design-v2.pen --prompt "Make the header larger and change the accent color to green" --export design-v2.png --export-scale 2 ``` ### Technical Analysis The Skill explicitly requires authenticated Pencil and Claude Code services and directs the agent to pass the user's request directly to the CLI's AI agent. It also supports supplying an existing `.pen` design as input for iteration. External AI processing is relevant to the declared design-generation functionality, so network access itself is not unnecessary. However, the Skill does not require a privacy notice or explicit approval before transferring user content. It also provides no data-classification check, secret redaction procedure, minimization rule, retention warning, or restriction on submitting confidential existing designs. Passing the prompt as a command-line argument additionally makes it potentially visible through process inspection, shell history, command logging, or agent execution logs, depending on the host environment. ### Attack Path 1. A user provides a design ...[truncated 1323 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The activation criteria are extremely broad, covering essentially any request for visual creation. Over-broad routing increases the chance this skill will be invoked in unrelated contexts, causing unnecessary tool use, package execution, authentication flows, or file generation beyond what the user specifically intended.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
**Pencil CLI npm package** (`@pencil.dev/cli`). The published package includes `SKILL.md` at its root; the package version is the skill version.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
**Pencil CLI npm package** (`@pencil.dev/cli`). The published package includes `SKILL.md` at its root; the package version is the skill version.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
**Pencil CLI npm package** (`@pencil.dev/cli`). The published package includes `SKILL.md` at its root; the package version is the skill version.

Self-Modification

High

Category: Rogue Agent
Confidence: 93% confidence
Finding: The skill explicitly instructs upgrading the CLI and refreshing the copied skill file, which amounts to self-modification of the agent's tooling/instructions. In agent contexts this is risky because it can persistently alter future behavior through remote-updated package content and replacement of local skill files.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

Latest version on the registry: npm view @pencil.dev/cli version

Installed CLI: pencil version, or npm list -g @pencil.dev/cli (global) / npm list @pencil.dev/cli (project)

Upgrade the CLI, then refresh your copied skill file (agents do not auto-update skill files you placed in config folders):

bash
npm install -g @pencil.dev/cli

Rp1

Medium

Category: MCP Rug Pull
Confidence: 78% confidence
Finding: Using npx pencil version without a pinned package version can cause execution of whatever package version npm resolves at runtime. In a skill context, this introduces supply-chain and reproducibility risk because the invoked code may change over time or be unexpectedly fetched from the network.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 78% confidence
Finding: The instruction to run via npx pencil leaves the package version unpinned, so the executed code can vary between runs and may be fetched dynamically. For an agent skill, this is risky because it normalizes execution of mutable third-party code without strong provenance guarantees.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs fetching SKILL.md from third-party URLs and copying it into local skill directories, but does not require explicit notice or consent for network access and filesystem modification. In an agent environment, this can lead to silent remote content retrieval and persistent local changes to agent behavior.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
| Environment | Where to put `SKILL.md` | |-------------|-------------------------| | **Cursor** | Project: `.cursor/skills/pencil-design/SKILL.md`; user-level: under `~/.cursor/skills/` | | **Claude Code** | Often `.claude/skills/pencil-design/SKILL.md` or user-level under `~/.claude/` | | **OpenClaw** | Often `~/.openclaw/skills/`, workspace `.agents/skills/`, or paths in [OpenClaw skills docs](https://docs.openclaw.ai/skills/) — verify for the user’s setup | | **Other agents (Codex, etc.)** | Use the directory your product uses for skills or prompts |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
md
| Environment | Where to put `SKILL.md` | |-------------|-------------------------| | **Cursor** | Project: `.cursor/skills/pencil-design/SKILL.md`; user-level: under `~/.cursor/skills/` | | **Claude Code** | Often `.claude/skills/pencil-design/SKILL.md` or user-level under `~/.claude/` | | **OpenClaw** | Often `~/.openclaw/skills/`, workspace `.agents/skills/`, or paths in [OpenClaw skills docs](https://docs.openclaw.ai/skills/) — verify for the user’s setup | | **Other agents (Codex, etc.)** | Use the directory your product uses for skills or prompts |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 86% confidence
Finding: The example combines remote fetch from a mutable third-party URL with writing directly into a live skill path, enabling persistent modification of agent behavior. This is more dangerous than plain path enumeration because it operationalizes installation into a sensitive configuration location.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
Example (adjust the destination path to match your agent):

bash
curl -fsSL "https://unpkg.com/@pencil.dev/cli@latest/SKILL.md" -o .cursor/skills/pencil-design/SKILL.md

When to check for an update

Static analysis

No suspicious patterns detected.