ctrl-clip

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple bash scripts (clip.sh, clip-setup.sh, clip-url-handler.sh) using the Bash tool to manage clipboard operations and system MIME type registration.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided or conversation-derived text (drafts for Slack, PRs, etc.) and reformats it. While it includes some boundary awareness by instructing the agent to keep commentary outside the blockquote, there is a minor risk of processing untrusted data that could influence the formatting or output process.
  • Ingestion points: Conversation history and user arguments describing content to copy (SKILL.md).
  • Boundary markers: Uses markdown blockquotes (>) to delimit content intended for the clipboard (SKILL.md).
  • Capability inventory: Writing files to local scratchpad or ~/.cache, executing shell scripts for clipboard operations, and modifying CLAUDE.md (clip-setup.sh).
  • Sanitization: clip.sh uses sed to strip specific terminal artifacts and markdown markers before copying.
  • [FILE_SYSTEM_ACCESS]: The skill reads and writes files in ~/.cache/claude-clip and optionally modifies CLAUDE.md. The clip-url-handler.sh script includes a security check to ensure it only processes files within the intended cache directory and rejects symbolic links to prevent arbitrary file read/write.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:50 PM