pp-paperclip

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the 'paperclip-pp-cli' utility using npx -y @mvanhorn/printing-press-library. This package is a vendor-owned resource matching the author's namespace.
  • [REMOTE_CODE_EXECUTION]: The use of npx during the installation phase involves fetching and executing code from the NPM registry at runtime.
  • [COMMAND_EXECUTION]: The skill's primary function is to wrap and execute numerous shell commands using the paperclip-pp-cli binary to interact with the platform's REST API.
  • [PROMPT_INJECTION]: The skill implements an 'Automatic Learning' loop (Category 8 surface) where the agent is instructed to run recall and follow instructions contained in 'playbooks' and 'notes' retrieved from a local store. This architecture processes data that could potentially influence agent behavior if the underlying data store or upstream API responses were manipulated.
  • [DATA_EXFILTRATION]: The CLI tool supports a --deliver webhook:<url> flag, which is a documented capability allowing the redirection of command output (including potentially sensitive configuration or secret data) to external network endpoints.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 09:18 AM
Security Audit — agent-trust-hub — pp-paperclip