📦
paperclip
81Coordinate Paperclip Tasks and Agents
Teams need a consistent way to coordinate agent work, approvals, and task progress. This skill guides Paperclip API workflows for assignments, updates, routines, and deliverables.
生産性 表示
スキル paperclip-create-agent
📦
paperclip-create-agent
コンテンツリビジョン r1 重大 ⚙️ 外部コマンド🌐 ネットワークアクセス📁 ファイルシステムへのアクセス🔑 環境変数
Create Governed Paperclip Agent Hires
Creating a new agent requires consistent configuration, a clear role charter, and the correct approval process. This skill guides Paperclip users through discovery, drafting, review, submission, and approval follow-up.
対応: Claude Codex Code(CC)
この Skill を自動インストールしないでください。
基準ポリシーにより、インストール操作の前にオペレーターのレビューが必要です。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "paperclip-create-agent" from https://skillstore.io/skills/getpaperclipai-paperclip-create-agent.md and its manifest at https://skillstore.io/api/skills/getpaperclipai-paperclip-create-agent/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「paperclip-create-agent」を使用しています。 Create a QA agent for mobile checkout testing.
期待される結果:
- Selected template: QA.
- Draft includes a QA charter, reporting line, adapter settings, and disabled heartbeats.
- Hire request is ready for approval review.
「paperclip-create-agent」を使用しています。 Prepare a security specialist for a private advisory workflow.
期待される結果:
- The draft requests confirmation of a confidential workflow before assigning sensitive disclosures.
- The capability justification identifies required access and leaves unneeded permissions out.
セキュリティ監査
重大v1 • 2026/7/20 バージョン別レポートを開く
Most static detections are Markdown formatting, local installation guidance, or documented use of an authenticated Paperclip API. Confirmed findings cover privileged API operations, API-key use, and two destructive reset commands that recursively delete the default embedded database. No prompt-injection text or credential-exfiltration intent was found.
10
スキャンされたファイル
1,292
解析済み行数
24
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (3)
重大
Recursive delete on root/home
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
重大
Recursive delete on root/home
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
高
Privileged Agent Capability Provisioning
The hire payload can assign adapter configuration and desired skills, including access-expanding capabilities. Governance guidance is present, but a privileged caller could create an agent with broader operational reach.
The documented payload explicitly accepts desiredSkills and adapter configuration, while the surrounding text acknowledges they can expand browser, external-system, filesystem, and secret-handling access.
機能レビュー項目 (24)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
重大
Hidden file in home directory
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
重大
Hidden file in home directory
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
重大
Hidden file access
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
重大
Hidden file access
rm -rf ~/.paperclip/instances/default/db
The documented command recursively deletes the default Paperclip database under the user home directory. A mistaken invocation permanently destroys local instance data.
高
Ruby/shell backtick execution
```sh
The documented curl command submits a privileged agent-hire request that can provision a new agent and its configured capabilities.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY" \
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY" \
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY" \
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
高
Generic API/secret keys
-H "Authorization: Bearer $PAPERCLIP_API_KEY"
The command reads an API key and transmits it in an Authorization header. This is intended for Paperclip, but endpoint configuration must be trusted and the credential is sensitive.
中
Shell command substitution
kill $(lsof -ti:3100)
The command kills every process listening on port 3100 without verifying ownership. It can stop an unrelated local service.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
中
Ruby/shell backtick execution
```sh
The documented curl command performs an authenticated Paperclip API operation. It has an external side effect or accesses governed company data.
リスク要因
⚙️ 外部コマンド (50)
references/agents/coder.md:52-53 references/agents/coder.md:53-54 references/agents/coder.md:54-64 references/agents/qa.md:79-80 references/agents/qa.md:80-88 references/agents/securityengineer.md:70-74 references/agents/securityengineer.md:74-76 references/agents/securityengineer.md:76 references/agents/securityengineer.md:80 references/agents/securityengineer.md:96-99 references/agents/securityengineer.md:99-114 references/agents/securityengineer.md:114-115 references/agents/securityengineer.md:115-132 references/agents/securityengineer.md:132-135 references/agents/uxdesigner.md:78 references/agents/uxdesigner.md:89-91 references/agents/uxdesigner.md:91 references/agents/uxdesigner.md:106-107 references/agents/uxdesigner.md:107-115 setup-installation.md:172 SKILL.md:15 SKILL.md:20 SKILL.md:28-31 SKILL.md:31-35 SKILL.md:35-42 SKILL.md:42-46 SKILL.md:46-49 SKILL.md:49-57 SKILL.md:57-58 SKILL.md:58 SKILL.md:59-62 SKILL.md:62-65 SKILL.md:65-71 SKILL.md:71-74 SKILL.md:74-79 SKILL.md:79-80 SKILL.md:80-82 SKILL.md:82-83 SKILL.md:83-85 SKILL.md:85 SKILL.md:88 SKILL.md:90 SKILL.md:91 SKILL.md:96-100 SKILL.md:100-118 SKILL.md:118-122 SKILL.md:122 SKILL.md:124-126 SKILL.md:126-134 SKILL.md:134-138
🌐 ネットワークアクセス (4)
📁 ファイルシステムへのアクセス (9)
検出されたパターン
Recursive delete on root/home×2
監査者: claude
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/getpaperclipai-paperclip-create-agent/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/getpaperclipai-paperclip-create-agent?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/getpaperclipai-paperclip-create-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/getpaperclipai-paperclip-create-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/getpaperclipai-paperclip-create-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
getpaperclipai. (2026). paperclip-create-agent security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/getpaperclipai-paperclip-create-agent/audits/1BibTeX形式の引用
@techreport{getpaperclipai-getpaperclipai-paperclip-create-agent-2026,
author = {getpaperclipai},
title = {paperclip-create-agent security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/getpaperclipai-paperclip-create-agent/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "paperclip-create-agent security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "getpaperclipai"
date-released: "2026-07-20"
url: "https://skillstore.io/skills/getpaperclipai-paperclip-create-agent/audits/1"
identifiers:
- type: other
value: "skillstore:getpaperclipai-paperclip-create-agent:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 低 50
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
83
仕様準拠
作成できるもの
Add an engineering agent
Create a coding agent that follows existing team conventions and reports to the correct manager.
Standardize a new role
Adapt a supplied role template into a governed configuration for a new business function.
Prepare an approval-ready hire
Review permissions, runtime settings, and issue links before sending a request to the board.
これらのプロンプトを試す
Create a basic role
Help me draft a Paperclip hire request for a QA agent. Use the existing QA template and ask for missing reporting-line details.
Compare current configurations
Inspect my Paperclip company agent configurations. Summarize naming, icon, adapter, and reporting-line conventions before proposing a new designer agent.
Create a governed specialist
Draft a SecurityEngineer hire request. Explain every requested capability, keep heartbeats disabled, and prepare it for board approval.
Handle an approved request
Review PAPERCLIP_APPROVAL_ID, list linked issues, and propose the correct close or comment action for each issue.
ベストプラクティス
- Confirm the current identity, company, and permissions before drafting a hire.
- Use the closest role template and remove instructions that do not fit the new role.
- Justify every capability that expands external access, filesystem scope, or secret handling.
回避
- Do not submit a hire with an unclear reporting line or role charter.
- Do not enable recurring heartbeats unless scheduled work is necessary and approved.
- Do not add browser, external-system, or secret access without a documented business need.
よくある質問
What access is required?
You need board access or the Paperclip permission can_create_agents=true for the target company.
Does the skill install Paperclip?
No. Paperclip must already be installed and running before using this skill.
Can I create a role without a template?
Yes. The baseline role guide supports a new AGENTS.md when no supplied template fits.
Does submitting a request activate the agent?
Not always. A response with an approval enters pending_approval until the board decides.
Can the skill enable heartbeats?
It keeps heartbeats disabled by default and enables them only for a justified scheduled role.
Does the skill assess third-party skills?
No. Review any desiredSkills and adapter capabilities separately before granting them to a new agent.
開発者情報
作成者
getpaperclipaiライセンス
MIT
Skillstore リビジョン
r1
バージョンに関する注意
作者はバージョンを宣言していません。
参照
1ecbf4900186c1926b52a48e893674f943d87c48
メンテナンスの新しさ
2026/7/20
利用状況
1 ダウンロード · 0 閲覧
getpaperclipai のその他のスキル
すべて表示📦
paperclip-converting-plans-to-tasks
77Convert Plans into Executable Tasks
Plans often fail when tasks lack owners, dependencies, or clear starting conditions. This skill turns accepted Paperclip plans into a verified task graph that supports focused and parallel execution.
生産性 表示
📦
design-guide
74建置一致的 Paperclip UI 元件
當元件、權杖與版面配置以臨時方式建立時，Paperclip UI 工作可能會逐漸偏離一致性。此技能為 Claude、Codex 和 Claude Code 提供共享的設計指南，以實作一致的前端。
デザイン＆クリエイティブ 表示
📦
paperclip-board
68Manage Your Paperclip Board Operations
Managing an AI-agent company can require many API calls and scattered operational checks. This skill turns board requests into structured Paperclip workflows for onboarding, approvals, monitoring, and review.
生産性 表示
📦
para-memory-files
38Organize lasting memory with PARA files
Important project context is easily lost between sessions. This skill stores it in structured files and helps retrieve it later with PARA and qmd.
生産性 表示
関連スキル
すべて表示📦
caveman-learn
77Reduce Agent Token Usage
作成者 juliusbrussee
Large configuration files and repeated context increase token usage. This skill reviews Caveman reports and applies measured changes with individual approval.
生産性 表示
📦
pricing-onboarding
77Set Up Pricing Context and Brand Voice
作成者 cmj-hub
Pricing guidance lacks relevance when current tiers, buyer context, and brand voice are missing. This skill collects and validates those details before preparing local configuration.
生産性 表示
📦
constitutional-writer
83從文件草擬專案憲章
作成者 Azeem-2
團隊經常將使命、價值觀和治理規則隱藏在分散的文件中。此技能會擷取這些元素，並將它們轉換成清晰的專案憲章。
ドキュメント 表示
📦
incident-command-governor
82建立受治理的事件指揮封包
作成者 yaojingang
事件筆記通常缺乏清楚的嚴重程度、負責歸屬，以及針對不同受眾的溝通內容。此技能會將營運證據轉換為受治理的封包，用於回應、檢討與後續追蹤。
DevOps＆インフラ 表示
📦
ai-ethics
81評估 AI 倫理風險
作成者 89jobrien
AI 團隊必須在部署前識別偏見、監督缺口和合規風險。此技能引導針對公平性、透明度、隱私、治理和負責任 AI 文件的結構化審查。
調査＆学習 表示
📦
lark-base
79使用 lark-cli 管理 Lark Base
作成者 larksuite
Lark Base 工作需要精確的命令、識別碼與欄位格式。此技能會引導 Claude、Codex 和 Claude Code 完成結構化的 lark-cli Base 工作流程。
オフィス＆レポート 表示