Paperclip

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:32 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for operating a local Paperclip control plane, but it asks agents to run mutable setup code and persist operational context without enough user control.

Install only if you trust the Paperclip package, repository, and any configured Paperclip deployment or adapters. Prefer pinning a reviewed package version or repository commit, run setup in an isolated environment, and require confirmation before saving Paperclip environment details or work context to persistent memory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: quickstart.md:5

Finding

Execution of an Unpinned npm Package

Content

View full analysis

Vulnerability Details

File Location: quickstart.md:5-7; also recommended in SKILL.md:44-46,56
Vulnerability Type: Supply-chain risk caused by mutable package resolution
Risk Level: Medium

Vulnerable code:

bash

npx paperclipai onboard --yes

Supporting instruction:

markdown

- Node.js 20+ for the official `paperclipai` package and local server
- pnpm 9.15+ for repo-based workflows
- `curl` for direct API checks and automation

- Prefer `npx paperclipai onboard --yes` for the first working instance.

Technical Analysis

The recommended setup command runs the version of paperclipai currently resolved by npm without specifying a reviewed version or verifying package integrity. The --yes option suppresses the installation confirmation that could otherwise alert the operator that code is about to be downloaded and executed.

Because the resolved package is mutable after this skill has been reviewed, compromise of the npm package, publisher credentials, package ownership, or registry resolution path could cause arbitrary package code or lifecycle scripts to execute locally. The project does not provide a version pin, expected checksum, trusted registry restriction, or lockfile-backed installation procedure for this setup path.

Attack Path

1. An attacker compromises the paperclipai npm package, its publisher account, or the package resolution infrastructure.
2. The attacker publishes a malicious version under the package name resolved by the unpinned command.
3. A user or agent follows the documented first-use setup procedure.
4. npx retrieves the current mutable package version without requiring interactive installation confirmation.
5. Malicious package lifecycle or application code executes with the permissions of the invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The resul ...[truncated 339 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to a specifically reviewed version, for example:

  bash

  npx --yes paperclipai@<reviewed-version> onboard --yes
  

• Document the expected npm registry and reject unexpected registry overrides.

• Publish and verify package provenance, signatures, or integrity hashes before execution.

• Prefer a lockfile-backed installation workflow with committed integrity metadata.

• Review package lifecycle scripts and consider disabling them during installation where operationally possible.

• Remove automatic confirmation suppression when interactive review is appropriate, or clearly warn users that the command downloads and executes third-party code.

T08 · Insecure Dependencies

Note

• Location: quickstart.md:13

Finding

Execution of an Unpinned Upstream Repository and Dependency Graph

Content

View full analysis

Vulnerability Details

File Location: quickstart.md:13-17
Vulnerability Type: Supply-chain risk caused by cloning and executing a mutable default branch
Risk Level: Low

Vulnerable code:

bash

git clone https://github.com/paperclipai/paperclip.git
cd paperclip
pnpm install
pnpm dev

Technical Analysis

The manual installation workflow clones the repository's current default branch without selecting a reviewed release tag or commit. It then installs the dependency graph and starts the project. Both the upstream repository contents and dependencies resolved during installation can change after this skill has been audited.

pnpm install may execute package lifecycle scripts, while pnpm dev executes scripts defined by the cloned repository. Consequently, compromise of the upstream repository, its maintainers, or a dependency can result in local code execution. Although the documented source is a declared GitHub repository rather than an overtly suspicious source, the procedure lacks immutable source selection and integrity verification.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or a dependency included in the installation graph.
2. Malicious code is added to the mutable default branch, a package lifecycle script, or a resolved dependency.
3. A user follows the documented manual repository workflow.
4. git clone retrieves the compromised default-branch content.
5. pnpm install resolves dependencies and may execute malicious lifecycle scripts.
6. pnpm dev executes the compromised project scripts with the invoking user's permissions.

Impact Assessment

Successful exploitation could produce arbitrary code execution as the invoking user. An attacker could potentially read or modify user-accessible files, project workspaces, Paperclip data, environment variables, and credentials exposed to the installation or development process. No p ...[truncated 119 chars]

Remediation

View remediation

Remediation Suggestions

• Clone or check out an immutable, reviewed release tag or full commit hash rather than relying on the default branch.

• Verify a signed release, signed commit, or published checksum before installation.

• Require the repository's committed lockfile and install with:

  bash

  pnpm install --frozen-lockfile
  

• Review package lifecycle scripts before allowing them to execute.

• Consider using --ignore-scripts during dependency installation when compatible with the project, followed by explicit execution of only required and reviewed build steps.

• Document the exact reviewed repository revision and dependency-lockfile hash in the setup guide.

• Run initial installation and development startup in an isolated, least-privileged environment without unrelated credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx paperclipai onboard --yes without pinning an exact package version. npx will fetch the latest published package at execution time, so a compromised maintainer account, dependency hijack, or malicious upstream release could result in arbitrary code execution on the user's machine. In this skill's context, that risk is more serious because the command is presented as the preferred first-use bootstrap path and is likely to be run immediately by operators.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · operations.md (reported line 16)May include surrounding context.

API Identity Check

bash

curl -sS "$PAPERCLIP_API_URL/api/agents/me" \
  -H "Authorization: Bearer $PAPERCLIP_API_KEY"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The quickstart instructs users to run npx paperclipai onboard --yes without pinning a specific package version. npx will fetch the latest published package at execution time, which creates a supply-chain risk: a compromised maintainer account, malicious new release, or unexpected breaking change could execute arbitrary code on the user's machine during onboarding. In a control-plane/orchestration skill, this is more dangerous because the package is likely to access local config, credentials, services, and automation workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to persist integration preferences and reusable operational context to the user's main memory without requiring clear user notice, consent, or data-minimization safeguards. Even if the data is not obviously secret, storing infrastructure details, workspaces, blockers, and deployment mode can create privacy leakage and unintended long-term profiling across sessions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.