paperclip-create-plugin
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute development commands including pnpm build, pnpm test, and node to run local scripts in SKILL.md sections 2 and 5.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface where user-supplied variables are used in shell commands.\n
- Ingestion points: User input for , , and enters the agent context in SKILL.md.\n
- Boundary markers: No delimiters or 'ignore embedded instructions' warnings are present for user-supplied data.\n
- Capability inventory: The skill possesses capabilities for subprocess calls via node and pnpm, as well as file-system interaction.\n
- Sanitization: No escaping, validation, or filtering of external content is specified before interpolation into shell commands.
Audit Metadata