ctrl-clip
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple bash scripts (
clip.sh,clip-setup.sh,clip-url-handler.sh) using theBashtool to manage clipboard operations and system MIME type registration. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided or conversation-derived text (drafts for Slack, PRs, etc.) and reformats it. While it includes some boundary awareness by instructing the agent to keep commentary outside the blockquote, there is a minor risk of processing untrusted data that could influence the formatting or output process.
- Ingestion points: Conversation history and user arguments describing content to copy (SKILL.md).
- Boundary markers: Uses markdown blockquotes (
>) to delimit content intended for the clipboard (SKILL.md). - Capability inventory: Writing files to local scratchpad or
~/.cache, executing shell scripts for clipboard operations, and modifyingCLAUDE.md(clip-setup.sh). - Sanitization:
clip.shusessedto strip specific terminal artifacts and markdown markers before copying. - [FILE_SYSTEM_ACCESS]: The skill reads and writes files in
~/.cache/claude-clipand optionally modifiesCLAUDE.md. Theclip-url-handler.shscript includes a security check to ensure it only processes files within the intended cache directory and rejects symbolic links to prevent arbitrary file read/write.
Audit Metadata