paperclip-org-builder
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill guides the user through a nine-stage organizational design process, storing intermediate state in a local JSON file (
paperclip-org-draft.json). This workflow is transparent and does not involve any hidden operations. - [COMMAND_EXECUTION]: The skill utilizes local Python scripts (
assemble-package.py,validate-draft.py, andvalidate-package.py) executed viauv run. These scripts perform standard file system operations, YAML generation, and data validation necessary for creating the organization's package structure. - [EXTERNAL_DOWNLOADS]: Stage 5 involves the discovery and addition of skills using the
skills.shecosystem via thenpx skillsCLI. This is a legitimate integration with a well-known service for extending agent capabilities, and the instructions recommend sourcing skills from established organizations. - [DATA_EXPOSURE]: No evidence of sensitive data harvesting or exfiltration was found. The skill operates exclusively within the user-defined project directory and does not access sensitive system paths like SSH keys or environment variables.
Audit Metadata