napkin
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses platform-specific shell commands such as pbpaste, xclip, and powershell to access the system clipboard. This grants the agent access to any content currently stored in the user's clipboard during the 'check the napkin' workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-generated content from the whiteboard through visual and text-based channels.
- Ingestion points: System clipboard (structured JSON) and the napkin-snapshot.png file located in ~/Downloads or ~/Desktop.
- Boundary markers: Absent. The skill does not provide delimiters or specific instructions for the agent to ignore or isolate potentially malicious commands embedded within the whiteboard text or sketches.
- Capability inventory: The agent utilizes the view tool for image interpretation, platform-specific commands for opening the browser, and shell commands for reading clipboard data.
- Sanitization: Absent. Content retrieved from the clipboard and interpreted from the image is not validated or sanitized before being processed by the model.
Audit Metadata