paperclip-board
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute
curlcommands through a bash shell to communicate with the Paperclip API. This is the intended operational model for managing company resources, agents, and tasks. - [EXTERNAL_DOWNLOADS]: The skill fetches necessary configuration data, adapter documentation, and icon lists from the
PAPERCLIP_API_URL. These downloads are scoped to the vendor's application environment and are required for the skill to guide the user through onboarding and hiring agents. - [PROMPT_INJECTION]: The skill processes data from external sources, such as issue comments, task descriptions, and decision logs fetched from the API. The instructions focus on conversational summarization but do not specify the use of boundary markers or sanitization for this ingested content, creating a standard surface for indirect prompt injection.
- [DATA_EXPOSURE]: The skill accesses the
PAPERCLIP_API_KEYenvironment variable for authenticated requests. It utilizes this sensitive information correctly by placing it in theAuthorizationheader rather than exposing it in command arguments or logs.
Audit Metadata