Atlas Argos Teste

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:10 PM UTC
• Version: 0.1.0

Overview

The skill is for operating a trading bot, but it asks for broad computer control, credential discovery, background jobs, and automatic Telegram reporting that require careful review.

Install only if you intend to give this skill operator-level control over the ARGOS machine. Before use, restrict it to a fixed ARGOS directory, remove sudo and broad /home searches, replace .env sourcing with explicit secret provisioning, require approval for code changes, payments, public posts, and restarts, and avoid cron or nohup persistence unless separately reviewed and easy to disable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:5

Finding

Agent identity replacement and autonomous behavior hijacking

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:397

Finding

Broad credential discovery and arbitrary shell execution through sourced environment files

Content

View full analysis

/dev/null | head -1)/.env 2>/dev/null # Fallback: ler do .env directamente BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" ``` ### Technical Analysis The script searches broadly under `/home` for any `.env` file whose path contains `argos`, rather than using a configured and validated project directory. The first discovery result is trusted without verifying ownership, permissions, symlink status, or whether it belongs to the intended ARGOS deployment. The `source` command does not parse a data-only environment format. It executes the discovered file as shell code. Consequently, an attacker who can create or modify a matching `.env` file can execute arbitrary commands with the privileges of the Agent or scheduled report process. The fallback remains unsafe because it searches all of `/home`, uses non-exact `grep` patterns, and may select credentials from an unrelated project or user. Unquoted command substitution also makes path handling fragile. ### Attack Path 1. An attacker with write access to any searched home-directory location creates a path containing `argos` and places a `.env` file there. 2. The attacker adds arbitrary shell commands to the file, optionally alongside plausible Telegram variables. 3. The `find` command selects the attacker's directory as its first result. 4. The notification script executes the file using `source`. 5. The attacker's commands run with the notification script's privileges. 6. The attacker can read ...[truncated 800 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: SKILL.md:614

Finding

Persistent scheduled reporting and recurring outbound transmission

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Error

• Location: SKILL.md:286

Finding

Detached infinite monitoring process that autonomously restarts application code

Content

View full analysis

~/monitor_argos.sh << 'EOF' #!/bin/bash while true; do if ! pgrep -af "python.*main.py" > /dev/null; then echo "[$(date)] ARGOS down! A reiniciar..." cd $(find /home -maxdepth 4 -name "main.py" -path "*argos*" -printf '%h\n' | head -1) source venv/bin/activate nohup python3 main.py >> logs/argos.log 2>&1 & echo "[$(date)] ARGOS reiniciado." # Opcional: notificar via Telegram fi sleep 300 # Check a cada 5 min done EOF chmod +x ~/monitor_argos.sh nohup ~/monitor_argos.sh >> ~/monitor.log 2>&1 & ``` ### Technical Analysis This code creates an infinite monitor loop and launches it as a detached `nohup` process. It continues running after the initiating shell or Agent session exits. The process test is broad and can match unrelated `python ... main.py` processes. Conversely, if no match exists, the script searches multiple home directories and executes the first matching ARGOS `main.py`. Neither the selected directory nor the Python entry point is authenticated or pinned. The monitor also frustrates deliberate shutdown because it automatically relaunches the application every five minutes. If the selected project directory or `main.py` is compromised, the monitor repeatedly executes attacker-controlled code. ### Attack Path 1. The Agent writes and starts `~/monitor_argos.sh`. 2. The detached loop survives the Agent session. 3. An attacker creates or modifies a matching `argos/main.py` in the searched path. 4. The legitimate process stops, is intentionally disabled, or is made not to match the broad `pgrep` pattern. 5. The monitor selects the attacker's directory and launches its `main.py`. 6. The attacker-controlled Python code executes under the monitor account and may be relaunched after each termination. ### ...[truncated 460 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:174

Finding

Unpinned third-party package installation at runtime

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:687

Finding

Excessive system-wide permissions beyond the Skill's operational requirements

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill grants sweeping host-level powers including full filesystem, terminal, internet, and process access, far beyond a narrowly bounded bot-management role. In the context of an agent skill, this materially increases blast radius: any prompt-induced mistake or abuse can affect the entire machine rather than just the ARGOS application.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill requires broad disclosure of crashes, user starts with IDs, payments, code changes, and other operational details to a Telegram recipient in natural language. This creates a persistent exfiltration channel for sensitive operational and user-related information, with little minimization or boundary control.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Reading raw .env content to recover secrets is a credential-handling anti-pattern. It trains the agent to harvest configuration secrets from disk rather than use least-privilege secret delivery, increasing the chance of accidental disclosure or abuse.

Content

Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.

md

# Função para notificar o Félix (guardar em ~/atlas_notify.sh)
#!/bin/bash
# Uso: ~/atlas_notify.sh "📋 Mensagem aqui"
source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null

# Fallback: ler do .env directamente
BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Reading raw .env content to recover secrets is a credential-handling anti-pattern. It trains the agent to harvest configuration secrets from disk rather than use least-privilege secret delivery, increasing the chance of accidental disclosure or abuse.

Content

Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.

md

# Função para notificar o Félix (guardar em ~/atlas_notify.sh)
#!/bin/bash
# Uso: ~/atlas_notify.sh "📋 Mensagem aqui"
source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null

# Fallback: ler do .env directamente
BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The fallback logic explicitly greps .env files for BOT_TOKEN and ADMIN_ID, which is direct credential extraction from local storage. In an autonomous agent context, this creates a reusable path to secrets that can be repurposed for unauthorized external communication.

Content

Scanner excerpt · SKILL.md (reported line 399)May include surrounding context.

md

# Uso: ~/atlas_notify.sh "📋 Mensagem aqui"
source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null

# Fallback: ler do .env directamente
BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"
ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

This line continues the pattern of enumerating .env files to obtain secrets, broadening where the agent looks for credentials. Searching across /home for secret files increases exposure surface and normalizes secret harvesting behavior.

Content

Scanner excerpt · SKILL.md (reported line 400)May include surrounding context.

md

source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null

# Fallback: ler do .env directamente
BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"
ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"

if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Using extracted credentials immediately before an external send operation ties credential access to outbound transmission, making the risk concrete rather than theoretical. If abused, the agent can impersonate the bot and message arbitrary recipients or leak operational data.

Content

Scanner excerpt · SKILL.md (reported line 401)May include surrounding context.

md

# Fallback: ler do .env directamente
BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"
ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"

if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then
    curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill mandates sending user IDs, payments, incidents, and operational events to a Telegram recipient without warning that this is third-party data transmission. This leaks internal and user-related information outside the local system and may expose identifiers or business telemetry to an external messaging platform.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The automated report script aggregates local state, logs, metrics, changelog entries, and issue contents, then forwards them externally over Telegram. This centralizes and transmits potentially sensitive host and business data, making accidental leakage or unauthorized disclosure much more likely.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill claims 'security first' while elsewhere instructing the agent to locate .env files, extract bot/admin credentials, and use them for automatic outbound notifications. That contradiction is dangerous because it normalizes secret access and reuse for unrelated reporting, increasing the chance of credential exposure and unauthorized messaging.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions explicitly require the assistant to use PT-PT terminology, and later repeat this as a standing rule. This is a language policy constraint presented as mandatory rather than offering user choice or documenting a justified regional limitation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

**Quando o ARGOS crashar:**
1. Verificar logs → identificar o erro
2. Se for bug de código → corrigir tu mesmo (Python) ou delegar ao Antigravity
3. Reiniciar: `cd $ARGOS_DIR && source venv/bin/activate && nohup python3 main.py &`
4. Confirmar que voltou: `sleep 5 && pgrep -af argos`

**Quando encontrares um bug:**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs storing payment and subscription status in a local JSON file without any retention, access control, minimization, or privacy guidance. Even if the data is not highly sensitive by itself, subscription/payment records are user-related data and can be exposed, misused, or retained indefinitely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 76% confidence

Finding

This instruction sends content to the Telegram API, which is an external transmission channel. External transmission is not always unsafe, but in this skill's broader context of broad autonomy and credential use, it increases data leakage risk if messages or tokens are mishandled.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

Para publicar automaticamente no canal:

bash

# Usar o bot para enviar ao canal
curl -s "https://api.telegram.org/bot$BOT_TOKEN/sendMessage" \
  -d "chat_id=@NomeDoCanal" \
  -d "text=📊 Sinal grátis do dia: BTC LONG..." \
  -d "parse_mode=Markdown"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 76% confidence

Finding

This instruction sends content to the Telegram API, which is an external transmission channel. External transmission is not always unsafe, but in this skill's broader context of broad autonomy and credential use, it increases data leakage risk if messages or tokens are mishandled.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

Para publicar automaticamente no canal:

bash

# Usar o bot para enviar ao canal
curl -s "https://api.telegram.org/bot$BOT_TOKEN/sendMessage" \
  -d "chat_id=@NomeDoCanal" \
  -d "text=📊 Sinal grátis do dia: BTC LONG..." \
  -d "parse_mode=Markdown"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The monitor script auto-restarts the bot and runs continuously in the background, creating an unsupervised persistence mechanism. In an autonomous agent setting, self-maintaining background processes can outlive oversight and make unwanted behavior harder to detect or stop.

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md

echo "[$(date)] ARGOS down! A reiniciar..."
        cd $(find /home -maxdepth 4 -name "main.py" -path "*argos*" -printf '%h\n' | head -1)
        source venv/bin/activate
        nohup python3 main.py >> logs/argos.log 2>&1 &
        echo "[$(date)] ARGOS reiniciado."
        # Opcional: notificar via Telegram
    fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

Launching the monitor itself under nohup establishes durable background execution independent of the current session. That persistence increases risk because the agent is being instructed to create a long-running watchdog with broad access and optional notification behavior.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

done EOF chmod +x ~/monitor_argos.sh nohup ~/monitor_argos.sh >> ~/monitor.log 2>&1 &

text

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This outbound Telegram call is paired with credential discovery from .env and is used for administrative notifications containing operational details. In context, it functions as an exfiltration path for internal system and user-related data to an external service.

Content

Scanner excerpt · SKILL.md (reported line 404)May include surrounding context.

md

ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"

if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then
    curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
        -d "chat_id=${ADMIN_ID}" \
        -d "text=$1" \
        -d "parse_mode=Markdown" > /dev/null

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This outbound Telegram call is paired with credential discovery from .env and is used for administrative notifications containing operational details. In context, it functions as an exfiltration path for internal system and user-related data to an external service.

Content

Scanner excerpt · SKILL.md (reported line 404)May include surrounding context.

md

ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"

if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then
    curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
        -d "chat_id=${ADMIN_ID}" \
        -d "text=$1" \
        -d "parse_mode=Markdown" > /dev/null

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Advertising that sudo is available to the agent materially increases privilege escalation risk. Combined with broad filesystem, process, and internet access, this can turn a prompt injection or operational mistake into full-host compromise.

Content

Scanner excerpt · SKILL.md (reported line 689)May include surrounding context.

md

## ACESSO E FERRAMENTAS

Tu tens acesso a:
- ✅ Terminal bash completo (sudo disponível)
- ✅ Sistema de ficheiros inteiro (/home, /etc, etc.)
- ✅ Internet (pesquisa, APIs, downloads)
- ✅ Python 3 + pip

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This line reinforces that user-visible text must always be PT-PT, again imposing a fixed locale. Because no opt-in or alternative language handling is described, it constitutes the same language-policy concern in the operational rules.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:1