paperclip

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs include direct links to an install shell script and an unversioned Python wheel (paperclip.whl) that, if fetched and executed/installed without published checksums or verification, are common vectors for malware distribution despite being on the vendor domain.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes an explicit runtime install that fetches-and-executes a remote installer via "curl -fsSL https://paperclip.gxl.ai/install.sh | bash" and an unpinned wheel "https://paperclip.gxl.ai/paperclip.whl" used by pip/uv, both of which download and run remote code during setup.