Pencil Design

Create high-quality visual designs — websites, app screens, dashboards, slides, marketing materials, social media graphics — using the Pencil CLI tool. Use t...

This skill appears to do what it says (drive the Pencil CLI), but the runtime instructions expect you to install an npm package, authenticate with Pencil (or set PENCIL_CLI_KEY), and have/authorize a Claude Code agent — none of which are declared in the registry metadata. Before installing or running any commands: 1) Inspect the npm package (@pencil.dev/cli) on npmjs.com or the package tarball and review its source and SKILL.md to make sure you trust it. 2) Prefer local install and npx usage over global npm install if you are unsure; avoid running npm install -g without review. 3) Do not paste secrets (PENCIL_CLI_KEY, Claude tokens) into prompts or env vars unless you understand where they are stored and who can access them; verify whether the CLI uploads data to a remote service. 4) If you must fetch SKILL.md from unpkg/jsDelivr, review the fetched file before copying into your agent's skills folder. 5) If possible, run first in an isolated environment/container. 6) Ask the publisher to update the skill metadata to list PENCIL_CLI_KEY and any Claude/agent credential requirements explicitly so you know what will be requested ahead of time.

Type: OpenClaw Skill Name: pencil-design Version: 1.0.0 The skill bundle provides a legitimate interface for the Pencil CLI design tool, allowing an agent to generate UI mockups and graphics. While the SKILL.md includes instructions for the agent to self-update by fetching its own definition from remote CDNs (unpkg.com/jsDelivr) and suggests using curl to install itself into configuration directories, these actions are clearly documented as maintenance procedures to stay in sync with the CLI version. There is no evidence of data exfiltration, malicious execution, or deceptive prompt injection.