temp-output-clipboard
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local bash script that interacts with system clipboard utilities including
pbcopy,wl-copy,xclip,xsel,clip.exe, andpowershell.exe. These operations are limited to the skill's primary purpose of providing clipboard access for generated text. - [PROMPT_INJECTION]: The skill's instructions utilize the
cat <<'EOF'heredoc pattern. This is a security best practice that prevents the shell from interpreting special characters or commands that might be present within the user-generated text during execution. - [DATA_EXPOSURE]: The skill writes output to the
/tmpdirectory using themktemputility. This is standard behavior for temporary file creation and is used here to store text before it is returned to the user or copied to the clipboard. - [SAFE]: The code implements input sanitization for the
--formatargument, ensuring that file extensions are restricted to alphanumeric characters, which prevents path traversal or shell injection via the extension field.
Audit Metadata