The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions in SKILL.md and references/installation.md to install the Paperclip CLI by fetching a remote script from GXL's official domain (https://paperclip.gxl.ai/install.sh) and piping it directly into bash. This allows for the execution of arbitrary remote code with the user's privileges.\n- [EXTERNAL_DOWNLOADS]: The documentation in references/python-sdk.md suggests installing the Python SDK from a direct wheel URL (https://paperclip.gxl.ai/paperclip.whl) rather than from a verified package registry like PyPI, bypassing standard dependency verification mechanisms.\n- [CREDENTIALS_UNSAFE]: Instructions in SKILL.md and references/cli-reference.md direct the agent to source the local .env file into the shell environment using [ -f .env ] && { set -a; . ./.env; set +a; }. While intended to load the PAPERCLIP_API_KEY, this practice exposes all secrets and environment variables stored in that file to the shell environment of the CLI tool.\n- [DATA_EXFILTRATION]: The paperclip fetch command, documented in references/repos-and-workspace.md, is designed to use the user's local browser cookies to authenticate requests to external websites. This capability could be exploited to exfiltrate session data or authentication tokens if the agent is directed to fetch an attacker-controlled URL via malicious data or indirect prompt injection.\n- [PERSISTENCE]: The installation process described in references/installation.md modifies shell configuration files (such as ~/.zshrc or ~/.bashrc) to add the tool's installation directory to the PATH, ensuring the CLI remains active and accessible across future shell sessions.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes large volumes of untrusted third-party documents including biomedical literature, regulatory filings, and clinical trials, which are interpolated into LLM prompts during analysis. \n
Ingestion points: Document content and metadata retrieved through search, cat, grep, and fetch commands in SKILL.md and references/map-reduce.md. \n
Boundary markers: Present in SKILL.md (Rule 7) as an instruction to the agent to treat all returned data as untrusted and to avoid following embedded instructions. \n
Capability inventory: The agent has access to shell command execution (via Bash Read Write) and network operations (via the paperclip binary and fetch command). \n
Sanitization: Absent; the skill relies on instructional warnings rather than programmatic filtering of ingested content.

paperclip