📦

审计历史

paperclip-create-agent - 1 审计

2026年7月20日 10:47

Most static detections are Markdown formatting, local installation guidance, or documented use of an authenticated Paperclip API. Confirmed findings cover privileged API operations, API-key use, and two destructive reset commands that recursively delete the default embedded database. No prompt-injection text or credential-exfiltration intent was found.

已扫描文件

1,292

分析行数

复核项

已忽略误报

已确认安全问题 (3)

严重

setup-installation.md:125

Recursive delete on root/home

rm -rf ~/.paperclip/instances/default/db

The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.

严重

setup-installation.md:201

Recursive delete on root/home

rm -rf ~/.paperclip/instances/default/db

The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.

高

SKILL.md:82-90 SKILL.md:100-117

Privileged Agent Capability Provisioning

The hire payload can assign adapter configuration and desired skills, including access-expanding capabilities. Governance guidance is present, but a privileged caller could create an agent with broader operational reach.

The documented payload explicitly accepts desiredSkills and adapter configuration, while the surrounding text acknowledges they can expand browser, external-system, filesystem, and secret-handling access.

能力复核项 (24)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

严重

setup-installation.md:125 setup-installation.md:201

Hidden file in home directory · 2 处

rm -rf ~/.paperclip/instances/default/db

The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.

严重

setup-installation.md:125 setup-installation.md:201

Hidden file access · 2 处

rm -rf ~/.paperclip/instances/default/db

The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.

高

SKILL.md:100-118

Ruby/shell backtick execution

```sh

The documented curl command submits a privileged agent-hire request that can provision a new agent and its configured capabilities.

高

SKILL.md:30 SKILL.md:37 SKILL.md:41 SKILL.md:48 SKILL.md:73 SKILL.md:128 SKILL.md:149 SKILL.md:152

Generic API/secret keys · 8 处

-H "Authorization: Bearer $PAPERCLIP_API_KEY"

The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.

高

SKILL.md:102 SKILL.md:131 SKILL.md:140

Generic API/secret keys · 3 处

-H "Authorization: Bearer $PAPERCLIP_API_KEY" \

The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.

中

setup-installation.md:172

Shell command substitution

kill $(lsof -ti:3100)

The command kills every process listening on port 3100 without verifying ownership. It can stop an unrelated local service.

中

SKILL.md:28-31 SKILL.md:35-42 SKILL.md:46-49 SKILL.md:71-74 SKILL.md:126-134 SKILL.md:138-143 SKILL.md:147-153

Ruby/shell backtick execution · 7 处

```sh

The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.