@paperclipai/server

Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise

Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys

Paperclip: OS Command Injection via Execution Workspace cleanupCommand

Paperclip: Malicious skills able to exfiltrate and destroy all user data

Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode

paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server

Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution