paperclip-create-plugin
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various commands for plugin development, including the
paperclipaiCLI tool andpnpmfor dependency management and testing. These commands are necessary for the skill's primary purpose of scaffolding and building local plugins. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent ingests and verifies content from locally generated files (e.g.,
src/manifest.ts,package.json). While this is a common attack surface for indirect prompt injection, it is managed here through the use of trusted vendor-owned scaffolding tools. - [SAFE]: The identified tools (
paperclipaiCLI) and packages (@paperclipai/create-paperclip-plugin) are recognized as official vendor resources from 'paperclipai', and their use follows standard developer best practices.
Audit Metadata