paste-image
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script to execute
osascript, a standard macOS utility, to interact with the system clipboard and file system. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the user's clipboard.
- Ingestion points: The
osascriptcommand inscripts/run.shreads PNG data directly from the macOS clipboard. - Boundary markers: None present.
- Capability inventory: The skill can write to the local file system using AppleScript's
writecommand and delete files usingrmin thescripts/run.shscript. - Sanitization: The script explicitly casts clipboard data to the
PNGfclass, ensuring it only processes image data and does not interpret other clipboard contents as instructions.
Audit Metadata