temp-output-clipboard

Pass

Audited by Gen Agent Trust Hub on Mar 31, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local bash script that interacts with system clipboard utilities including pbcopy, wl-copy, xclip, xsel, clip.exe, and powershell.exe. These operations are limited to the skill's primary purpose of providing clipboard access for generated text.
  • [PROMPT_INJECTION]: The skill's instructions utilize the cat <<'EOF' heredoc pattern. This is a security best practice that prevents the shell from interpreting special characters or commands that might be present within the user-generated text during execution.
  • [DATA_EXPOSURE]: The skill writes output to the /tmp directory using the mktemp utility. This is standard behavior for temporary file creation and is used here to store text before it is returned to the user or copied to the clipboard.
  • [SAFE]: The code implements input sanitization for the --format argument, ensuring that file extensions are restricted to alphanumeric characters, which prevents path traversal or shell injection via the extension field.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 31, 2026, 03:31 PM