Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md [api-fields.md](references/api-fields.md#external-operational-delivery-context)
Security audit
atoll
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Atoll integration skill that can make real project-management changes and optionally set up a local runner, but the sensitive behavior is scoped, documented, and user-controlled.
Install this only if you intend to let an agent work with Atoll. Use the least-privileged Atoll profile that fits the task, keep API keys out of chat and comments, and review carefully before enabling runner services, webhooks, project deletion, board-column deletion, or other destructive/admin actions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (33)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md [api-fields.md](references/api-fields.md#external-operational-delivery-context)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md [api-fields.md](references/api-fields.md#external-operational-delivery-context)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md [api-fields.md](references/api-fields.md#external-operational-delivery-context)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md [api-fields.md](references/api-fields.md#external-operational-delivery-context)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md [api-fields.md](references/api-fields.md#external-operational-delivery-context)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md [api-fields.md](references/api-fields.md#external-operational-delivery-context)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md [api-fields.md](references/api-fields.md#external-operational-delivery-context)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md [integrations-and-api.md](references/integrations-and-api.md)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Exact endpoint inventory: [api-endpoints.md](references/api-endpoints.md)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Exact endpoint inventory: [api-endpoints.md](references/api-endpoints.md)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Exact endpoint inventory: [api-endpoints.md](references/api-endpoints.md)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Exact endpoint inventory: [api-endpoints.md](references/api-endpoints.md)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Exact endpoint inventory: [api-endpoints.md](references/api-endpoints.md)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Exact endpoint inventory: [api-endpoints.md](references/api-endpoints.md)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Base URL: `https://atollhq.com` Endpoints accept an Atoll API key or an OAuth 2.1 access token. OAuth tokens are bound to the exact public MCP resource. Actor-dependent OAuth requests execute as the connection-authorized agent selected by per-call `profile_ref`, or the sole usable profile when the selector is omitted.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md Disable revokes the agent's API keys and OAuth profile grants. It preserves execution, attention, assignment, and membership history. Enable does not restore credentials or resume work. Issue a fresh key or authorize a fresh OAuth profile after enable. Old pending OAuth consent and old runner leases cannot regain authority after enable. Each lease keeps an immutable `agent_lifecycle_version`; obsolete primary tokens, aliases, replays, completions, and attention acknowledgements fail closed. This does not stop an external process. Revoke is terminal. It cancels active execution and attention under the existing revoke contract and keeps identity and history. Legacy `DELETE /api/orgs/{id}/agents/{agentId}` remains a human-only revoke adapter with `{ "success": true }`; repeated authorized DELETE succeeds. It does not delete the identity. Authorized inventory/detail responses expose `can_enable`, `can_disable`, `can_revoke`, `can_manage_keys`, `can_manage_access`, `can_manage_profile`, and `can_manage_heartbeat` under `capabilities`. These reflect current state and management permission. Disabled agents allow enable/revoke; revoked agents allow history only. Project read authority alone grants no management permission. Historical access facts never grant effective access to an inactive agent.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ## Local runner presence `GET`, `PUT`, and `DELETE /api/orgs/{id}/runners/self` are agent-only. The organization and agent member come from authentication. `PUT` accepts `instanceId`, optional `hostId` (the server-bound host routing identity), `platform` (`darwin`, `linux`, or `windows`), `arch` (`arm64`, `x64`, or `amd64`), `capabilities` (unique values from `codex` and `git`),
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md The modern public OAuth MCP endpoint (`https://atollhq.com/mcp`, version `2026-07-28`) advertises `events` and supports `events/list`, `events/subscribe`, and `events/unsubscribe`. Legacy 2025 tool calls remain supported. No event subscriptions are available to API-key, private or stdio identities. The authenticated adapter uses `POST /api/mcp-events/subscriptions` to create/refresh and `DELETE /api/mcp-events/subscriptions` to unsubscribe. Resolve the OAuth connection and optional `X-Atoll-Agent-Profile` through existing auth. Request fields are the protocol `name`, `arguments`, `delivery`, optional `ttlMs`, and optional `cursor: null`. Profile selection travels in the header, not business filters. Events: `issue.status_changed` (`project_id`, optional `issue_id`, `from_status`, `to_status`); `attention.created` (`project_id`, optional `kind`); `execution.state_changed` (`project_id`, optional `issue_id`, `to_state`). Project and issue UUIDs must be readable in the selected profile; status keys must exist in the project's workflow.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md `approval|clarification|access|decision|destructive_action|other`. Supply the execution's expected state version, title, request summary, why needed, resume condition, exactly one member/team/project-admin target, and an idempotency key. Never put credentials, access tokens, private paths, prompts, logs, or other secrets in attention text. Server permissions and concealed 404 responses remain authoritative; do not try another identity to bypass them.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md Uploads use multipart field `file`, must be non-empty, and are limited to 10 MiB (`413` when exceeded). Declared images must be signature-valid PNG, JPEG, GIF, or WebP; SVG and other declared image types are rejected. Other files are accepted but forced to download as `application/octet-stream`. † `DELETE /issues/{id}` requires `owner` or `admin` role — any caller without that role (including member-role agents) gets `403`. If you just need to remove a task, use `POST /api/orgs/{orgId}/issues/{issueId}/archive` (soft delete, no role gate); reverse with `DELETE` on the same path (unarchive). In the CLI, prefer `atoll issue archive <id>`. Permanent `atoll issue delete <id>` requires `--force` and supports `--dry-run`. ### Quick enum reference
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation description is extremely broad, covering generic planning, execution, project-management, and integration requests. That can cause the skill to trigger in contexts where Atoll is not actually needed, increasing the chance that an agent follows this skill’s extensive operational instructions, accesses external systems unnecessarily, or performs unintended reads/writes.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 55% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md proof, 403 for a non-human/non-admin caller, 404 for a missing connection or mapping, 409 for `configuration_changed`, `mapping_has_history`, `mapping_limit`, or `connection_limit`, and 503 for transient provider, secret-key, or storage failure. Connection configuration uses an exact version fence; read the saved state before retrying an uncertain write. ## Compact Context index
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md `expected_revision_number`). Supply the changed title and/or full content. A title-only change still creates a full immutable revision. A stale revision returns a conflict: reread and reconcile the changes before any new write; never retry with a refreshed expectation without checking the content. After create, revise, or link, read back the Artifact and the issue manifest when applicable. Verify the selected revision, content, and intended link.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md `expected_revision_number`). Supply the changed title and/or full content. A title-only change still creates a full immutable revision. A stale revision returns a conflict: reread and reconcile the changes before any new write; never retry with a refreshed expectation without checking the content. After create, revise, or link, read back the Artifact and the issue manifest when applicable. Verify the selected revision, content, and intended link.
Static analysis
No suspicious patterns detected.