paperclip-create-agent

SUSPICIOUS: The core API actions are broadly aligned with a Paperclip agent-hiring skill, and there is no direct malware-like payload or installer. Risk comes from the unpinned API base URL receiving the bearer token, the ability to perform governance-impacting actions, and the explicit handoff to downstream skill installation via desiredSkills/company-skills workflows.