📦
paperclip
81Coordinate Paperclip Tasks and Agents
Teams need a consistent way to coordinate agent work, approvals, and task progress. This skill guides Paperclip API workflows for assignments, updates, routines, and deliverables.
效率 查看
技能 paperclip-create-agent
📦
paperclip-create-agent
内容修订 r1 严重 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量
Create Governed Paperclip Agent Hires
Creating a new agent requires consistent configuration, a clear role charter, and the correct approval process. This skill guides Paperclip users through discovery, drafting, review, submission, and approval follow-up.
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "paperclip-create-agent" from https://skillstore.io/skills/getpaperclipai-paperclip-create-agent.md and its manifest at https://skillstore.io/api/skills/getpaperclipai-paperclip-create-agent/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“paperclip-create-agent”。 Create a QA agent for mobile checkout testing.
预期结果:
- Selected template: QA.
- Draft includes a QA charter, reporting line, adapter settings, and disabled heartbeats.
- Hire request is ready for approval review.
正在使用“paperclip-create-agent”。 Prepare a security specialist for a private advisory workflow.
预期结果:
- The draft requests confirmation of a confidential workflow before assigning sensitive disclosures.
- The capability justification identifies required access and leaves unneeded permissions out.
安全审计
严重v1 • 2026/7/20 打开版本化报告
Most static detections are Markdown formatting, local installation guidance, or documented use of an authenticated Paperclip API. Confirmed findings cover privileged API operations, API-key use, and two destructive reset commands that recursively delete the default embedded database. No prompt-injection text or credential-exfiltration intent was found.
10
已扫描文件
1,292
分析行数
24
复核项
0
已忽略误报
已确认安全问题 (3)
严重
Recursive delete on root/home
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
严重
Recursive delete on root/home
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
高
Privileged Agent Capability Provisioning
The hire payload can assign adapter configuration and desired skills, including access-expanding capabilities. Governance guidance is present, but a privileged caller could create an agent with broader operational reach.
The documented payload explicitly accepts desiredSkills and adapter configuration, while the surrounding text acknowledges they can expand browser, external-system, filesystem, and secret-handling access.
能力复核项 (24)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
严重
Hidden file in home directory
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
严重
Hidden file in home directory
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
严重
Hidden file access
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
严重
Hidden file access
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
高
Ruby/shell backtick execution
```sh
The documented curl command submits a privileged agent-hire request that can provision a new agent and its configured capabilities.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY" \
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY" \
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY" \
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
中
Shell command substitution
kill $(lsof -ti:3100)
The command kills every process listening on port 3100 without verifying ownership. It can stop an unrelated local service.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
风险因素
⚙️ 外部命令 (50)
references/agents/coder.md:52-53 references/agents/coder.md:53-54 references/agents/coder.md:54-64 references/agents/qa.md:79-80 references/agents/qa.md:80-88 references/agents/securityengineer.md:70-74 references/agents/securityengineer.md:74-76 references/agents/securityengineer.md:76 references/agents/securityengineer.md:80 references/agents/securityengineer.md:96-99 references/agents/securityengineer.md:99-114 references/agents/securityengineer.md:114-115 references/agents/securityengineer.md:115-132 references/agents/securityengineer.md:132-135 references/agents/uxdesigner.md:78 references/agents/uxdesigner.md:89-91 references/agents/uxdesigner.md:91 references/agents/uxdesigner.md:106-107 references/agents/uxdesigner.md:107-115 setup-installation.md:172 SKILL.md:15 SKILL.md:20 SKILL.md:28-31 SKILL.md:31-35 SKILL.md:35-42 SKILL.md:42-46 SKILL.md:46-49 SKILL.md:49-57 SKILL.md:57-58 SKILL.md:58 SKILL.md:59-62 SKILL.md:62-65 SKILL.md:65-71 SKILL.md:71-74 SKILL.md:74-79 SKILL.md:79-80 SKILL.md:80-82 SKILL.md:82-83 SKILL.md:83-85 SKILL.md:85 SKILL.md:88 SKILL.md:90 SKILL.md:91 SKILL.md:96-100 SKILL.md:100-118 SKILL.md:118-122 SKILL.md:122 SKILL.md:124-126 SKILL.md:126-134 SKILL.md:134-138
🌐 网络访问 (4)
📁 文件系统访问 (9)
检测到的模式
Recursive delete on root/home×2
审计者: claude
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/getpaperclipai-paperclip-create-agent/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/getpaperclipai-paperclip-create-agent?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/getpaperclipai-paperclip-create-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/getpaperclipai-paperclip-create-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/getpaperclipai-paperclip-create-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
getpaperclipai. (2026). paperclip-create-agent security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/getpaperclipai-paperclip-create-agent/audits/1BibTeX 引用
@techreport{getpaperclipai-getpaperclipai-paperclip-create-agent-2026,
author = {getpaperclipai},
title = {paperclip-create-agent security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/getpaperclipai-paperclip-create-agent/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "paperclip-create-agent security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "getpaperclipai"
date-released: "2026-07-20"
url: "https://skillstore.io/skills/getpaperclipai-paperclip-create-agent/audits/1"
identifiers:
- type: other
value: "skillstore:getpaperclipai-paperclip-create-agent:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 低 50
架构
85
可维护性
87
内容
65
社区
83
规范符合性
你能构建什么
Add an engineering agent
Create a coding agent that follows existing team conventions and reports to the correct manager.
Standardize a new role
Adapt a supplied role template into a governed configuration for a new business function.
Prepare an approval-ready hire
Review permissions, runtime settings, and issue links before sending a request to the board.
试试这些提示
Create a basic role
Help me draft a Paperclip hire request for a QA agent. Use the existing QA template and ask for missing reporting-line details.
Compare current configurations
Inspect my Paperclip company agent configurations. Summarize naming, icon, adapter, and reporting-line conventions before proposing a new designer agent.
Create a governed specialist
Draft a SecurityEngineer hire request. Explain every requested capability, keep heartbeats disabled, and prepare it for board approval.
Handle an approved request
Review PAPERCLIP_APPROVAL_ID, list linked issues, and propose the correct close or comment action for each issue.
最佳实践
- Confirm the current identity, company, and permissions before drafting a hire.
- Use the closest role template and remove instructions that do not fit the new role.
- Justify every capability that expands external access, filesystem scope, or secret handling.
避免
- Do not submit a hire with an unclear reporting line or role charter.
- Do not enable recurring heartbeats unless scheduled work is necessary and approved.
- Do not add browser, external-system, or secret access without a documented business need.
常见问题
What access is required?
You need board access or the Paperclip permission can_create_agents=true for the target company.
Does the skill install Paperclip?
No. Paperclip must already be installed and running before using this skill.
Can I create a role without a template?
Yes. The baseline role guide supports a new AGENTS.md when no supplied template fits.
Does submitting a request activate the agent?
Not always. A response with an approval enters pending_approval until the board decides.
Can the skill enable heartbeats?
It keeps heartbeats disabled by default and enables them only for a justified scheduled role.
Does the skill assess third-party skills?
No. Review any desiredSkills and adapter capabilities separately before granting them to a new agent.
开发者详情
许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
1ecbf4900186c1926b52a48e893674f943d87c48
维护新鲜度
2026/7/20
使用量
1 次下载 · 0 次浏览
getpaperclipai 的更多技能
查看全部📦
paperclip-converting-plans-to-tasks
77Convert Plans into Executable Tasks
Plans often fail when tasks lack owners, dependencies, or clear starting conditions. This skill turns accepted Paperclip plans into a verified task graph that supports focused and parallel execution.
效率 查看
📦
design-guide
74构建一致的 Paperclip UI 组件
当组件、token 和布局以临时方式创建时，Paperclip UI 工作可能会发生偏移。此技能为 Claude、Codex 和 Claude Code 提供共享设计指南，用于实现一致的前端实现。
设计与创意 查看
📦
paperclip-board
68Manage Your Paperclip Board Operations
Managing an AI-agent company can require many API calls and scattered operational checks. This skill turns board requests into structured Paperclip workflows for onboarding, approvals, monitoring, and review.
效率 查看
📦
para-memory-files
38Organize lasting memory with PARA files
Important project context is easily lost between sessions. This skill stores it in structured files and helps retrieve it later with PARA and qmd.
效率 查看
相关技能
查看全部📦
caveman-learn
77Reduce Agent Token Usage
由 juliusbrussee
Large configuration files and repeated context increase token usage. This skill reviews Caveman reports and applies measured changes with individual approval.
效率 查看
📦
pricing-onboarding
77Set Up Pricing Context and Brand Voice
由 cmj-hub
Pricing guidance lacks relevance when current tiers, buyer context, and brand voice are missing. This skill collects and validates those details before preparing local configuration.
效率 查看
📦
constitutional-writer
83根据文档起草项目章程
由 Azeem-2
团队常常把使命、价值观和治理规则分散隐藏在各类文档中。此技能会提取这些要素，并将其整理成清晰的项目章程。
文档 查看
📦
incident-command-governor
82构建受治理的事件指挥包
由 yaojingang
事件记录通常缺少清晰的严重性、负责人和面向不同受众的沟通内容。此技能可将运营证据转化为用于响应、复盘和跟进的受治理包。
DevOps 与基础设施 查看
📦
ai-ethics
81评估 AI 伦理风险
由 89jobrien
AI 团队必须在部署前识别偏见、监督缺口和合规风险。此技能可指导围绕公平性、透明度、隐私、治理和负责任 AI 文档开展结构化评审。
研究与学习 查看
📦
lark-base
79使用 lark-cli 管理 Lark Base
由 larksuite
Lark Base 工作需要精确的命令、标识符和字段格式。此技能会引导 Claude、Codex 和 Claude Code 完成结构化的 lark-cli Base 工作流。
办公与报告 查看