Atlas Tracker

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:28 AM UTC
• Version: 1.0.5

Overview

The skill is broadly aligned with Atlas Tracker work, but it asks users to install and persist unreviewed external code and gives under-scoped API and credential guidance.

Review this carefully before installing. Only use MCP server and plugin files from a verifiable official source, inspect their source and lockfiles, avoid enabling the systemd service until you trust the code, protect AUTH_HEADER and API_KEY as secrets, and confirm every local file path before upload.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:16

Finding

Execution of Unverified Externally Supplied Server and Plugin Code

Content

View full analysis

The AT MCP server is maintained by the Atlas Tracker / RedForester team. > Contact **@gmdidro** (Telegram) or visit [app.redforester.com](https://app.redforester.com) to request access. Once you have the server files: ```bash cd at-mcp/ yarn install yarn build # Run directly node build/index.js # Or run as a systemd user service (recommended) cp at-mcp.service ~/.config/systemd/user/ ``` ``` ### Technical Analysis The Skill directs users to acquire security-critical MCP server files through an unspecified external process that includes contacting a Telegram account. It then instructs users to install dependencies, build the project, and execute the generated JavaScript. The audited package does not contain the MCP server source, its package manifest, a lockfile, the plugin source, integrity hashes, release signatures, or a verifiable source repository. Consequently, neither the supplied code nor its dependency graph can be evaluated as part of this audit. Executing `yarn install` may run dependency lifecycle scripts, while `node build/index.js` runs the externally supplied application directly. If the distribution account, supplied archive, package registry dependency, or build chain is compromised, arbitrary code can execute with the privileges of the user performing the installation. ### Attack Path 1. An attacker compromises or impersonates the external distribution contact, website, download location, or one of the server's dependencies. 2. The attacker provides a modified MCP package or introduces a malicious dependency or lifecycle script. 3. The user follows the Skill instructions and runs `yarn install`. 4. The malicious p ...[truncated 1027 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: SKILL.md:27

Finding

Persistent Execution of an Unreviewed MCP Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/api-patterns.md:5

Finding

Atlas Password Exposure Through Unsafe Shell-Based Basic Authentication Construction

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Scope Creep

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented REST endpoints introduce capabilities not declared in the skill metadata, including listing maps, searching nodes, and fetching arbitrary nodes directly. In a security-sensitive agent environment, this mismatch can let the agent attempt broader discovery and retrieval than users or reviewers expect, increasing the risk of unauthorized data enumeration and exfiltration.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Or run as a systemd user service (recommended)

cp at-mcp.service ~/.config/systemd/user/ systemctl --user daemon-reload systemctl --user enable --now at-mcp

text

The server listens on `http://localhost:3222` by default.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Copy the plugin file to your OpenClaw extensions directory:

bash

mkdir -p ~/.openclaw/extensions/atlas-tracker/
cp index.ts ~/.openclaw/extensions/atlas-tracker/
cp openclaw.plugin.json ~/.openclaw/extensions/atlas-tracker/

Scope Creep

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent/user to use the Atlas Tracker REST API directly for search operations, even though the declared skill capability is framed around MCP tools. This expands the effective trust boundary and can lead to undeclared network access, bypass of tool-level controls, and inconsistent auditing or permission enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill encourages uploading any local file path to a remote Atlas Tracker node without an explicit warning, consent checkpoint, or data-sensitivity guidance. That creates a clear risk of unintended exfiltration of local secrets, private documents, SSH keys, credentials, or other sensitive files from the host environment to an external service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The reference file instructs the agent to bypass the manifest-declared MCP tool workflow and perform direct HTTP requests with custom authentication. That expands the operational surface beyond the audited tool boundary, enabling ungoverned data access patterns and weakening permission, logging, and policy controls that the MCP tools are supposed to enforce.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The authentication example normalizes constructing an Authorization header from a password-derived value and provides no warning about secure credential handling. This encourages unsafe secret use in prompts, scripts, logs, or shell history, and the MD5-based password handling is especially weak by modern standards if users imitate it outside a controlled environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill requires AUTH_HEADER derived from username/password and an API_KEY, but the documentation does not include any caution that these values are sensitive credentials. In a markdown skill description, omission of warnings about privacy- or security-impacting behaviour can qualify as a missing user warning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The document lists common node types only in Russian (Идея, Задача, etc.), which can imply a fixed language expectation without user opt-in. SQP-3 covers language or locale policy violations when a skill forces or assumes a specific language without documenting choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The document instructs users to match property names exactly and all provided examples and common node types use Russian labels such as "Суть идеи", "Статус", and "Идея". Because the guide does not state that this is map-specific or region-specific, it reads as a locale-specific requirement without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.