paperclip-board

Pass

Audited by Gen Agent Trust Hub on Aug 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is designed to execute curl commands through a bash shell to communicate with the Paperclip API. This is the intended operational model for managing company resources, agents, and tasks.
  • [EXTERNAL_DOWNLOADS]: The skill fetches necessary configuration data, adapter documentation, and icon lists from the PAPERCLIP_API_URL. These downloads are scoped to the vendor's application environment and are required for the skill to guide the user through onboarding and hiring agents.
  • [PROMPT_INJECTION]: The skill processes data from external sources, such as issue comments, task descriptions, and decision logs fetched from the API. The instructions focus on conversational summarization but do not specify the use of boundary markers or sanitization for this ingested content, creating a standard surface for indirect prompt injection.
  • [DATA_EXPOSURE]: The skill accesses the PAPERCLIP_API_KEY environment variable for authenticated requests. It utilizes this sensitive information correctly by placing it in the Authorization header rather than exposing it in command arguments or logs.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 15, 2026, 07:22 PM
Security Audit — agent-trust-hub — paperclip-board