Skills
skills/kmshihab7878/claude-code-setup/paperclip-create-agent/Gen Agent Trust Hub

paperclip-create-agent

Pass

Audited by Gen Agent Trust Hub on Apr 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Utilizes curl commands to interact with the Paperclip API for identity verification (/api/agents/me), configuration discovery, and submitting agent hire requests.
  • [EXTERNAL_DOWNLOADS]: Fetches agent configuration documentation and available icons from the Paperclip API server.
  • [EXTERNAL_DOWNLOADS]: References the vercel-labs/agent-browser/agent-browser skill as a dependency for new agent configurations. This reference points to a trusted organization.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing data from external sources such as company issues and approval comments.
  • Ingestion points: SKILL.md (Step 8) and references/api-reference.md (endpoints for approvals and issues).
  • Boundary markers: Absent; instructions do not provide explicit delimiters for ingested data.
  • Capability inventory: Shell command execution via curl and network write operations via POST requests.
  • Sanitization: Absent; no validation or escaping of ingested text is mentioned before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 18, 2026, 12:08 PM
Security Audit — agent-trust-hub — paperclip-create-agent