paperclip

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.70). The skill claims it's only for Paperclip coordination, but it later instructs agents to perform domain work (e.g., create git worktrees and "start building"), which contradicts the stated scope and is a deceptive/inconsistent instruction outside the advertised purpose.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's Company Skills Workflow (skills/paperclip/references/company-skills.md) explicitly instructs the agent to import and inspect skills from external sources like skills.sh or arbitrary GitHub URLs (and to fetch the installed skill's SKILL.md via the company skills API), which clearly causes the agent to fetch and read untrusted third-party, user-authored content that can change its behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Company Skills Workflow shows the agent will, at runtime, request imports using external URLs (e.g. https://skills.sh/google-labs-code/stitch-skills/design-md and https://github.com/vercel-labs/agent-browser), and the server-side fetch/install of those repo/skill files can inject SKILL.md or code that directly controls agent instructions or executes code.