pp-paperclip
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the 'paperclip-pp-cli' utility using
npx -y @mvanhorn/printing-press-library. This package is a vendor-owned resource matching the author's namespace. - [REMOTE_CODE_EXECUTION]: The use of
npxduring the installation phase involves fetching and executing code from the NPM registry at runtime. - [COMMAND_EXECUTION]: The skill's primary function is to wrap and execute numerous shell commands using the
paperclip-pp-clibinary to interact with the platform's REST API. - [PROMPT_INJECTION]: The skill implements an 'Automatic Learning' loop (Category 8 surface) where the agent is instructed to run
recalland follow instructions contained in 'playbooks' and 'notes' retrieved from a local store. This architecture processes data that could potentially influence agent behavior if the underlying data store or upstream API responses were manipulated. - [DATA_EXFILTRATION]: The CLI tool supports a
--deliver webhook:<url>flag, which is a documented capability allowing the redirection of command output (including potentially sensitive configuration or secret data) to external network endpoints.
Audit Metadata