paperclip-distill
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an Indirect Prompt Injection surface because it ingests untrusted content (issue descriptions, comment bodies, and document text) from the Paperclip platform.
- Ingestion points: As described in the 'Workflow' and 'Inputs' sections of SKILL.md, the agent reads user-generated comments and issue data.
- Boundary markers: The skill does not define specific delimiters (e.g., XML tags or triple quotes) to isolate processed data from its internal instructions.
- Capability inventory: The agent has the ability to write to the project wiki using the
wiki_write_pagetool. - Sanitization: The skill mitigates risk by requiring 'wiki-insightful' interpretation and synthesis rather than raw procedural dumping, which acts as a natural filter against simple injection payloads.
- [DATA_EXFILTRATION]: The skill contains a 'Paperclip Asset Gate' policy which explicitly forbids the agent from dereferencing URLs, fetching content from
/api/assets/:id/content, or accessing attachments. This proactive instruction prevents the agent from being used to bypass access controls or exfiltrate binary assets during the distillation process.
Audit Metadata