The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Documentation within the skill references the domain paperclip.right.link, which has been explicitly flagged as malicious or blacklisted by automated security scanners.
[CREDENTIALS_UNSAFE]: The skill's instructions require the agent to access and read sensitive local files, specifically ~/.paperclip/auth.json and ~/.paperclip/context.json, which contain authentication tokens and API keys. It also details how to use these tokens in shell commands, increasing the risk of credential exposure in logs or process trees.
[COMMAND_EXECUTION]: The skill involves the execution of sensitive shell commands, including global package installations (npm install -g paperclipai) and system-level tool configurations (claude mcp add).
[PROMPT_INJECTION]: The skill exhibits a significant indirect prompt injection surface by ingesting untrusted data from external sources such as Paperclip issue descriptions, comments, and wiki pages. This is combined with powerful write capabilities (API mutations and wiki management), creating a risk where malicious instructions embedded in issues or wiki content could be executed by the agent.
Ingestion points: SKILL.md (reading issues and plan documents), references/docs/paperclip-operator/cli-contract.md (fetching wiki page content).
Boundary markers: None identified; external content is processed as part of the triage logic without delimiters or "ignore instructions" warnings.
Capability inventory: paperclipai CLI (mutating issues and projects), paperclip-wiki-manage (writing to wiki pages), and direct REST API calls via curl for record patching.
Sanitization: No evidence of sanitization or validation of the ingested external strings is provided in the instructions.

creator-triage