·
Last changedVersion:
This version passed the hardening gate. Hardening applied 5 targeted changes and preserved all other text. Classified findings before hardening: 7. Classified findings closed: 4. Classified findings remaining: 3. Unclassified scanner findings remaining: 0. Review findings closed: 8. Review findings remaining: 14.
2
5
1
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/component-patterns.md | Prompt Injection | Direct prompt injection | Medium | Open | |
references/setup-troubleshooting.md | Excessive Agency & Rogue Autonomy | — | Medium | Closed | |
SKILL.md | Malicious Code & Command Execution | Command injection | Low | Open | |
references/setup-troubleshooting.md | Malicious Code & Command Execution | — | Low | Closed | |
references/setup-troubleshooting.md | Tool & MCP Manipulation | MCP configuration abuse | Low | Closed | |
references/setup-troubleshooting.md | Malicious Code & Command Execution | Command injection | Low | Open | |
references/setup-troubleshooting.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Closed |
7 findings
Create professional, user-centered designs in Penpot using the penpot/penpot-mcp MCP server and proven UI/UX principles.
| Tool | Purpose |
|---|---|
| Run JavaScript in Penpot plugin context to create/modify designs |
| Export shapes as PNG/SVG for visual inspection |
| Import images (icons, photos, logos) into designs |
| Retrieve Penpot API documentation |
The Penpot MCP tools require the penpot/penpot-mcp server running locally. For detailed installation and troubleshooting, see setup-troubleshooting.md.
Always check if the MCP server is already available before attempting setup:
Try calling a tool first: Attempt mcp__penpot__penpot_api_info - if it succeeds, the server is running and connected. No setup needed.
If the tool fails, ask the user:
Only proceed with setup instructions if the user confirms the server is not installed.
Then in Penpot:
http://localhost:4400/manifest.jsonAdd to settings.json:
| Issue | Solution |
|---|---|
Plugin won't connect | Check servers are running ( |
Browser blocks localhost | Allow local network access prompt |
Tools not appearing in client | Restart VS Code/Claude completely after config changes |
Tool execution fails/times out | Ensure Penpot plugin UI is open and shows "Connected" |
"WebSocket connection failed" | Check firewall allows ports 4400, 4401, 4402 |
| Task | Reference File |
|---|---|
MCP server installation & troubleshooting | |
Component specs (buttons, forms, nav) | |
Accessibility (contrast, touch targets) | |
Screen sizes & platform specs |
mcp__penpot__execute_code with penpotUtils.shapeStructure() to see hierarchypenpotUtils.findShapes() to locate elements by type or namepenpot.createBoard(), penpot.createRectangle(), penpot.createText() etc.addFlexLayout() for responsive containersmcp__penpot__export_shape to visually check your workBefore creating designs, determine if the user has an existing design system:
If user HAS a design system:
If user has NO design system:
width/height are READ-ONLY → use shape.resize(w, h)parentX/parentY are READ-ONLY → use penpotUtils.setParentXY(shape, x, y)insertChild(index, shape) for z-ordering (not appendChild)dir="column" or dir="row"text.resize(), reset growType to "auto-width" or "auto-height"Always check existing boards before creating new ones to avoid overlap:
Board spacing guidelines:
Use these defaults only when user has no design system. Always prefer user's tokens if available.
| Token | Value | Usage |
|---|---|---|
| 4px | Tight inline elements |
| 8px | Related elements |
| 16px | Default padding |
| 24px | Section spacing |
| 32px | Major sections |
| 48px | Page-level spacing |
| Level | Size | Weight | Usage |
|---|---|---|---|
Display | 48-64px | Bold | Hero headlines |
H1 | 32-40px | Bold | Page titles |
H2 | 24-28px | Semibold | Section headers |
H3 | 20-22px | Semibold | Subsections |
Body | 16px | Regular | Main content |
Small | 14px | Regular | Secondary text |
Caption | 12px | Regular | Labels, hints |
| Purpose | Recommendation |
|---|---|
Primary | Main brand color, CTAs |
Secondary | Supporting actions |
Success | #22C55E range (confirmations) |
Warning | #F59E0B range (caution) |
Error | #EF4444 range (errors) |
Neutral | Gray scale for text/borders |
Before finalizing any design:
Use these validation approaches with mcp__penpot__execute_code:
| Check | Method |
|---|---|
Elements outside bounds |
|
Text too small (<12px) |
|
Missing contrast | Call |
Hierarchy structure |
|
Use penpot.generateStyle(selection, { type: 'css', includeChildren: true }) via mcp__penpot__execute_code to extract CSS from designs.
Get started with chainctlchainctl skill install public/github/penpot-uiux-design:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/github/skills/penpot-uiux-design:latest
MIT
HARDENING.md
LICENSE
SKILL.md
references/accessibility.md
references/component-patterns.md
references/platform-guidelines.md
references/setup-troubleshooting.md