此报告尚无所请求语言的翻译，当前显示规范英文报告。
版本化安全评估
报告编号: SA-1ECBF490
7/20/2026, 10:47:06 AM
paperclip-create-agent 安全评估 v1
Skill 安全认证报告
扫描器版本 3.0.0 审计模型: claude 最新发布的报告
- 技能名称
- paperclip-create-agent
- 版本
- v1
- 维护者
- getpaperclipai
- 覆盖范围
- 10 已扫描文件 · 1,292 分析行数
- 策略版本
- skillstore-security-audit-policy-v1
已确认问题的最高严重性
严重
有 3 个已确认的安全问题需要处理。
安装上下文
请查看当前 Skill 详情页
本页仅汇总报告证据。Skill 详情页提供 canonical install advisory。
打开当前 Skill 详情页本报告不会阻止或授权 manifest 或 ZIP。
Most static detections are Markdown formatting, local installation guidance, or documented use of an authenticated Paperclip API. Confirmed findings cover privileged API operations, API-key use, and two destructive reset commands that recursively delete the default embedded database. No prompt-injection text or credential-exfiltration intent was found.
报告位置
最新发布的报告
“最新”仅指报告序列，不代表 artifact 当前有效。
审计证明
有效证明
此精确报告有可公开验证的证明。
人工验证
未进行人工验证
本报告没有人工验证记录。
覆盖范围
10 已扫描文件 · 1,292 分析行数
有 27 项内容需要查看
局限
本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。
证据链
证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。
来源
已绑定 commit 与路径
构件
已绑定内容与 tree hash
审计
已完成
观察到的能力
“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。
包含脚本
可能执行 Skill 随附的代码。
本次审计未记录
网络访问
可能连接外部服务。
在 2 个证据位置观察到
文件系统访问
可能读取或写入本地文件。
在 5 个证据位置观察到
环境变量
可能读取进程环境中的值。
在 12 个证据位置观察到
外部命令
可能调用 Skill 之外的命令或程序。
在 52 个证据位置观察到
能力复核项 (24)
严重
Hidden file in home directory
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
严重
Hidden file in home directory
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
严重
Hidden file access
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
严重
Hidden file access
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
高
Ruby/shell backtick execution
```sh
The documented curl command submits a privileged agent-hire request that can provision a new agent and its configured capabilities.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY" \
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY" \
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY" \
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
中
Shell command substitution
kill $(lsof -ti:3100)
The command kills every process listening on port 3100 without verifying ownership. It can stop an unrelated local service.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
风险问题
已确认的安全问题与仍需审核的项目分开展示。
已确认安全问题 (3)
RISK-001 严重
Recursive delete on root/home
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
RISK-002 严重
Recursive delete on root/home
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
RISK-003 高
Privileged Agent Capability Provisioning
The hire payload can assign adapter configuration and desired skills, including access-expanding capabilities. Governance guidance is present, but a privileged caller could create an agent with broader operational reach.
The documented payload explicitly accepts desiredSkills and adapter configuration, while the surrounding text acknowledges they can expand browser, external-system, filesystem, and secret-handling access.
补救措施
本次审计记录了建议的修复措施。实施这些措施是维护者的责任。
- FIX-001严重Reset instructions recursively delete a directory under the user home directory.Require an explicit path check and interactive confirmation before deletion. Prefer a dedicated reset command with safeguards.
- FIX-002高Hire requests can grant adapters and desired skills with expanded access.Enforce server-side allowlists and approval requirements for capability increases, including browser, filesystem, network, and secret access.
- FIX-003高API credentials are passed to the configured Paperclip endpoint in command examples.Document trusted endpoint configuration, use least-privilege scoped keys, and avoid printing request headers in logs.
- FIX-004中The troubleshooting command kills every process listening on port 3100.Identify the Paperclip-managed process before stopping it, and require confirmation before sending a signal.
专家证据
不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。
Artifact 主体
- Marketplace 提交
- 1ecbf4900186c1926b52a48e893674f943d87c48
- 内容哈希
- cba0ba5a342958df859e38b7a0fc90692cb4e4f4e3140f1912f49d1d26cc7663
- 目录树哈希
- e221757eba8fc6588a8481116367ee543ba043c7e5007ce3e948f173b0f2aa4c
- Skill 路径
- skills/getpaperclipai/paperclip-create-agent
- 审计载荷哈希
- 3c17691bbb76b14dbac9f6096d97f678
分析元数据
审计模型: claude
分析状态: 已完成
范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。
验证与导出
manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。
审计证明: active