Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a coherent PinePaper canvas reference, but it exposes destructive canvas actions and an undefined training-data export tool without clear safeguards or scope.
Review before installing if you will use PinePaper with sensitive or valuable canvas content. Agents should confirm before clearing, resetting, or deleting selected items, and should not use the training-data export tool unless the user explicitly asks and understands what will be exported.
The skill describes destructive operations such as agent.reset, app.clearCanvas(), and undo-history-affecting actions without warning that they can erase existing work. In an agent context, that omission increases the chance an LLM invokes these commands during normal task flow, causing silent data loss or disruption of the user's project.
Listing pinepaper_delete_selected among MCP tools without any safety guidance exposes a direct deletion capability that an agent may call on the active selection with no user awareness. Because selections can be broad or accidental, this creates a realistic path to destructive actions and permanent loss if undo is unavailable or not used promptly.
The skill advertises a pinepaper_export_training_data tool even though the surrounding document is framed as a graphics/canvas creation reference, not a data collection or model-training workflow. Exposing training-data export without clear scope, consent, or data-boundary documentation can enable unintended extraction of user-created content and metadata for secondary use.
No suspicious patterns detected.
