The Agent Skills Directory

[SAFE]: The skill implements secure credential management by requiring API keys to be provided via environment variables (PAPERCLIP_BRIDGE_API_KEY or PAPERCLIP_API_KEY) rather than in prompt text. It also includes explicit warnings against printing or sharing these keys.
[SAFE]: The helper script (paperclip-task.mjs) performs data sanitization on API responses. Functions like issueSummary and commentSummary extract only specific metadata fields (IDs, titles, statuses, etc.) while omitting potentially large or untrusted text bodies (like task descriptions or comment content). This significantly mitigates the risk of indirect prompt injection from externally controlled data.
[SAFE]: No external package dependencies are utilized. The script uses only standard Node.js built-in modules (node:fs/promises) and the native fetch API, minimizing the supply chain attack surface.
[SAFE]: The documentation promotes the use of "scoped" API keys (task_bridge scope), which follows the principle of least privilege by restricting the agent's access to only the necessary boundaries (specific projects or tasks) rather than providing full account access.

paperclip-task-bridge