paste-image

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a bash script to execute osascript, a standard macOS utility, to interact with the system clipboard and file system.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the user's clipboard.
  • Ingestion points: The osascript command in scripts/run.sh reads PNG data directly from the macOS clipboard.
  • Boundary markers: None present.
  • Capability inventory: The skill can write to the local file system using AppleScript's write command and delete files using rm in the scripts/run.sh script.
  • Sanitization: The script explicitly casts clipboard data to the PNGf class, ensuring it only processes image data and does not interpret other clipboard contents as instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 02:51 PM