Atlas Avatar

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:05 AM UTC
• Version: 1.0.9

Overview

This skill is for Atlas avatar workflows, but it asks agents to run mutable external code while API secrets are present and stores those secrets on disk.

Install only if you are comfortable with this skill cloning/updating external repositories, running npm install, and storing Atlas plus optional LLM or ElevenLabs keys in a local .env.local file. Use dedicated low-privilege API keys, inspect or pin the external repos before running setup, avoid optional secrets unless needed, and do not point ATLAS_AGENT_REPO or ATLAS_REALTIME_EXAMPLE_GIT at untrusted paths or URLs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup-realtime-viewer.sh:23

Finding

Mutable External Viewer Code Is Retrieved and Executed with API Secrets Available

Content

View full analysis

&2 exit 2 else (cd "$DEST" && git pull --ff-only) || echo "(warn) git pull failed — continuing" fi cd "$DEST" TMP_ENV="$(mktemp)" trap 'rm -f "$TMP_ENV"' EXIT { printf 'ATLAS_API_KEY=%s\n' "$ATLAS_API_KEY" printf 'ATLAS_API_URL=%s\n' "$BASE" } >"$TMP_ENV" for v in LLM_API_KEY LLM_BASE_URL LLM_MODEL ELEVENLABS_API_KEY ELEVENLABS_VOICE_ID; do eval "val=\${$v:-}" if [[ -n "${val}" ]]; then printf '%s=%s\n' "$v" "$val" >>"$TMP_ENV" fi done mv "$TMP_ENV" .env.local trap - EXIT chmod 600 .env.local || true echo "== npm install (may take a minute)" npm install ``` ### Technical Analysis The setup process clones or updates a remote Git repository without pinning a reviewed commit, tag, or content digest. The effective code executed by the Skill can therefore change after the Skill package itself has been reviewed. The `ATLAS_REALTIME_EXAMPLE_GIT` environment variable also permits the source repository to be replaced with an arbitrary URL. After retrieval, the script writes `ATLAS_API_KEY` and optional LLM and ElevenLabs credentials into `.env.local`, then invokes `npm install`. npm installation can execute lifecycle scripts declared by the retrieved project or its dependencies. Such scripts run with the invoking user's o ...[truncated 2132 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/atlas_session.py:35

Finding

Environment-Controlled Repository Path Loads and Executes Unverified Python Code

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Python Dependency Is Installed from a Mutable Version Range Without Integrity Hashes

Content

View full analysis

=2.28.0,<3 ``` ### Technical Analysis The dependency specification permits any `requests` release from version 2.28.0 up to, but excluding, version 3. It does not pin a specifically reviewed artifact and provides no cryptographic hashes. As a result, two installations performed at different times can resolve to different code despite using the same Skill package. Package installation also depends on the configured Python package index and its trustworthiness. While `requests` is a widely used legitimate package and there is no evidence that the currently available releases are malicious, this configuration lacks reproducibility and supply-chain integrity enforcement. ### Attack Path 1. An attacker compromises a permitted package release, the configured package index, a package mirror, or dependency-resolution infrastructure. 2. The user runs `pip install -r requirements.txt`. 3. pip resolves a compromised artifact that satisfies `requests>=2.28.0,<3`. 4. The compromised package is installed into the Skill's environment. 5. Malicious behavior executes during installation or when the Atlas client imports and uses the package. 6. The code may access Atlas credentials, uploaded media, API responses, and other data available to the Python process. ### Impact Assessment A compromised dependency would execute with the privileges of the user or Agent running Python. It could potentially access: - `ATLAS_API_KEY` and other process environment variables. - Face images and audio files submitted to Atlas. - LiveKit session tokens and presigned result URLs. - User-readable workspace files. - Network resources accessible to the invoking process. The vulnerability does not itself provide ...[truncated 140 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Most of the declared core purpose matches the code: it starts realtime passthrough sessions, supports face image input, issues view-only viewer tokens, creates offline avatar generation jobs from audio+image, and manages realtime session state. However, the description explicitly says offline MP4 renders are posted to Discord via webhook, and this code chunk has no Discord integration at all—only an optional callback URL passed to Atlas during offline job creation. Additionally, the code exposes extra capabilities not mentioned in the description: listing and polling jobs, fetching result URLs, and querying account/health/index endpoints. The main material mismatch is the missing Discord-posting behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code does relate to Atlas realtime viewing, but only as an installation/bootstrap script for a local example application. It clones a GitHub repo, configures environment variables, installs dependencies, and provides instructions for running a browser app. It does not itself call Atlas APIs to create realtime passthrough avatar sessions, mint watch-only viewer tokens, render offline lip-sync videos, or post renders to Discord. Because the declared description presents broader operational capabilities that are absent from this code chunk, this is a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The instructions tell users to place ATLAS_API_KEY and possibly other secrets into .env.local inside a cloned application directory. Storing live credentials in local project files increases exposure through accidental commits, local compromise, backup leakage, or dependency/script access during development workflows.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

git clone https://github.com/NorthModelLabs/atlas-realtime-example.git cd atlas-realtime-example npm install cp .env.example .env.local # set ATLAS_API_KEY (+ optional LLM / ElevenLabs — see example file) npm run dev

http://localhost:3000 — full README: https://github.com/NorthModelLabs/atlas-realtime-example#readme

text

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

1. **Location:** the skill is usually at **`<openclaw-workspace>/skills/atlas-avatar/`** (path varies — locate `SKILL.md` next to `scripts/`).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill explicitly notes that optional LLM and ElevenLabs credentials are copied into the example app’s .env.local for the voice loop. Concentrating multiple third-party API keys in a browser-app project directory broadens the blast radius of accidental disclosure and makes compromise of the example app or its toolchain more damaging.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

bash

export ATLAS_API_KEY="…"   # already in env in practice
export ATLAS_API_BASE="${ATLAS_API_BASE:-https://api.atlasv1.com}"   # optional
# Optional — copied into the example app’s .env.local for mic + voice loop:
# export ELEVENLABS_API_KEY=… ELEVENLABS_VOICE_ID=…
# export LLM_API_KEY=… LLM_BASE_URL=… LLM_MODEL=…

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 75)May include surrounding context.

md

**409:** `session_not_active` if not `active`.

### `DELETE /v1/realtime/session/{id}`

**200:** `status`, `duration_seconds`, `estimated_cost`, `credits_deducted_cents`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup-realtime-viewer.sh (reported line 2)May include surrounding context.

sh

#!/usr/bin/env bash
# Clone or update the official atlas-realtime-example Next app and write .env.local
# from your shell env (so you can talk to the avatar in the browser after npm run dev).
#
# Requires: git, npm, curl. Uses ATLAS_API_KEY (required).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup-realtime-viewer.sh (reported line 13)May include surrounding context.

sh

#!/usr/bin/env bash
# Clone or update the official atlas-realtime-example Next app and write .env.local
# from your shell env (so you can talk to the avatar in the browser after npm run dev).
#
# Requires: git, npm, curl. Uses ATLAS_API_KEY (required).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup-realtime-viewer.sh (reported line 56)May include surrounding context.

sh

#!/usr/bin/env bash
# Clone or update the official atlas-realtime-example Next app and write .env.local
# from your shell env (so you can talk to the avatar in the browser after npm run dev).
#
# Requires: git, npm, curl. Uses ATLAS_API_KEY (required).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The script moves a temporary file containing API keys and optional LLM/TTS secrets into .env.local within the application directory, creating a persistent credential store that may later be read by tools, exposed by misconfiguration, or accidentally committed. In this skill context, the script is specifically preparing a web app environment, so writing multiple third-party service secrets into a project directory meaningfully increases exposure risk.

Content

Scanner excerpt · scripts/setup-realtime-viewer.sh (reported line 54)May include surrounding context.

sh

fi
done

mv "$TMP_ENV" .env.local
trap - EXIT
chmod 600 .env.local || true

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares shell and environment-dependent behavior but does not define an explicit tool scope or allowed-tools boundary. In an agent environment, that omission increases the chance the skill can invoke broader shell operations than users expect, especially since it instructs cloning repos, installing packages, and writing config files.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

Discoverability

bash

curl -sS "${ATLAS_API_BASE:-https://api.atlasv1.com}/"

Health & capacity

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/api-reference.md (reported line 135)May include surrounding context.

md

## OpenClaw / agents

Prefer **`python3 core/atlas_cli.py …`** from the monorepo root (see `skills/atlas-avatar/SKILL.md`) for a single maintained client; **`curl`** remains valid for minimal environments. For production, a typed OpenClaw **plugin** avoids shell entirely.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_atlas_cli.py (reported line 31)May include surrounding context.

python

file=sys.stderr,
        )
        sys.exit(2)
    sys.exit(subprocess.call([sys.executable, str(cli), *sys.argv[1:]]))


if __name__ == "__main__":

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script persists ATLAS and optional LLM/TTS credentials from the current shell into .env.local on disk, but it does not clearly warn the user that secrets will be written to a file inside a cloned application directory. This increases the chance of accidental secret exposure through backups, shell workflows, local compromise, or accidental inclusion in source control despite the chmod 600 attempt.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup-realtime-viewer.sh (reported line 56)May include surrounding context.

sh

mv "$TMP_ENV" .env.local
trap - EXIT
chmod 600 .env.local || true

echo "== npm install (may take a minute)"
npm install

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation directs users to clone a repository, write a .env.local file from secrets, and run npm install without prominently warning that this copies credentials into a project directory and executes third-party install scripts. If the cloned repo or dependencies are compromised, API keys could be exposed or arbitrary code could run during installation.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency specification allows any requests release from 2.28.0 up to, but not including, 3.0. Because the version is not pinned to a known-safe patched release, installs may resolve to a version affected by one or more published advisories, depending on when and where the skill is deployed. In a skill that interacts with external APIs and may handle webhook or token-based traffic, dependency drift increases supply-chain and runtime security uncertainty.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script invokes another Python program via subprocess.call, which is a safety-relevant operation for code files under this rule. While the module docstring explains path resolution, it does not disclose that the script will execute the target CLI, and there is no prompt or runtime notice before doing so.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.