Pencil Renderer

PassAudited by ClawScan on May 1, 2026.

Overview

This is a narrow Pencil design-rendering skill with no code files, but it can create or modify Pencil documents through an MCP backend.

This skill looks coherent and purpose-aligned for rendering Pencil frames. Before installing, make sure you trust the publisher and the configured Pencil MCP backend, and use it only with design documents you are comfortable letting the agent create or modify.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may add or change frames in a Pencil document as part of rendering.

Why it was flagged

The core workflow sends batch design operations to Pencil, which can create or modify content in a .pen document. This is aligned with the renderer purpose but should be used only on intended files.

Skill content
mcp__pencil__batch_design({
  filePath: "<path>.pen",
  operations: `...`
})
Recommendation

Use this skill with a trusted Pencil MCP backend and confirm the target document or parent frame before invoking it on important design files.

What this means

You are relying on instruction text from an unknown source and on whatever Pencil MCP server is available in your environment.

Why it was flagged

The skill has no runnable package in the artifacts, but its provenance is not documented and its external Pencil MCP dependency is not represented as an install requirement.

Skill content
Source: unknown
Homepage: none
Install specifications: No install spec — this is an instruction-only skill.
Recommendation

Install only if you trust the publisher and verify that the connected Pencil MCP server is the one you intend to use.

What this means

Design inputs and generated screenshots may pass through the configured Pencil MCP backend.

Why it was flagged

The skill is designed to be called by orchestrators and to send rendering requests through a Pencil MCP backend. This is expected for the purpose, but the artifact does not define the backend’s trust boundary.

Skill content
Use when: design-exploration or other orchestrators need to render
visual proposals using Pencil MCP backend.
Recommendation

Avoid sending confidential design content unless the Pencil MCP backend is trusted and approved for that data.