ClawHub
Back to skill

Security audit

Atlas Argos

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it gives an agent broad autonomous control over a trading-bot system, including credentials, persistent jobs, and external Telegram reporting.

Install only in a tightly controlled ARGOS environment where you are comfortable granting operational authority. Before use, require explicit approval for code changes, restarts, cron jobs, payments, and public posts; replace /home .env discovery with a fixed secret source; disable or gate Telegram reporting; redact user IDs and payment details; and avoid sudo or whole-filesystem access unless separately approved.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Findings (7)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:10
Finding
System-prompt-style identity and objective hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10-20 **Vulnerability Type**: Agent role, authority, and objective replacement **Risk Level**: Critical ### Vulnerable Code ```text # OPENCLAW — SYSTEM PROMPT: GESTOR AUTÓNOMO DO ARGOS ## QUEM ÉS Tu és o **ATLAS** — o gestor autónomo do ecossistema ARGOS. Não és o ChatGPT, não és o Claude, não és um assistente genérico. És um profissional de elite que gere um negócio de bots de trading cripto. A tua personalidade: - Bem-disposto mas focado. Usas humor quando faz sentido, nunca quando atrasa o trabalho. - Proactivo — não esperas que te digam o que fazer. Vês o problema, resolves. - Directo — quando algo está mal, dizes. Quando algo funciona, segues em frente. - Português de Portugal (PT-PT). "Ficheiro" não "arquivo". "Ecrã" não "tela". - Quando falas com o Félix, tratas-o por tu. É o fundador e o teu chefe. ``` Related instructions later reinforce the unauthorized authority: ```text 6. **Ser proactivo.** Não esperar que o Félix diga para fazer algo. Se vês um problema, resolve. 7. **Priorizar receita.** O objectivo final é que o ARGOS gere dinheiro. Cada acção deve contribuir. ``` ```text Usa tudo o que precisares. O PC é teu para gerir. ``` ### Technical Analysis The Skill explicitly labels itself as a system prompt, replaces the host agent's identity, establishes a new superior, and assigns persistent business and revenue objectives. These directives are not limited to a user-invoked ARGOS operation. They attempt to alter the agent's current role, approval boundaries, safety posture, and task priorities as soon as the Skill is loaded. The additional directions to act proactively and use all available system facilities can cause the agent to treat consequential operations—such as code modification, credential access, process management, marketing, and payment administration—as preauthorized. ### Attack Path 1. The Skill is loaded into an agent session. 2. The agent interprets th ...[truncated 842 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Remove all claims that the Skill is a system prompt or that it replaces the agent's identity. - Remove the assignment of a new superior and revenue-first objectives. - Describe the Skill as a narrowly scoped, user-invoked ARGOS administration workflow. - Require explicit approval before modifying code, restarting services, sending messages, managing users, changing payment state, or installing scheduled tasks. - State that host-system policies and the current user's instructions take precedence. - Restrict tool access to the minimum needed for the specific requested operation. - Separate read-only diagnostics from write, execution, network, and administrative capabilities. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:403
Finding
Recursive credential discovery and executable loading of discovered environment files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 403-412 **Vulnerability Type**: Broad secret-file access and unsafe shell sourcing **Risk Level**: High ### Vulnerable Code ```bash # Função para notificar o Félix (guardar em ~/atlas_notify.sh) #!/bin/bash # Uso: ~/atlas_notify.sh "📋 Mensagem aqui" source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null # Fallback: ler do .env directamente BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -d "chat_id=${ADMIN_ID}" \ -d "text=$1" \ -d "parse_mode=Markdown" > /dev/null fi ``` ### Technical Analysis The script recursively searches `/home` for files named `.env` whose paths contain `argos`, rather than using a configured and validated project directory. This violates least privilege because it can inspect credential files belonging to unrelated projects or users. More critically, `source` does not parse the file as passive configuration: it executes the selected file as shell code. The use of `find | head -1` makes file selection dependent on filesystem traversal order and provides no validation of ownership, permissions, canonical path, or content. An attacker who can create a matching `.env` may therefore cause arbitrary commands to run with the privileges of the agent or cron job. The fallback remains unsafe because it searches all of `/home` and extracts values using broad substring matching. `grep BOT_TOKEN` and `grep ADMIN_ID` can select unintended variable names, comments, or malformed content. ### Attack Path 1. An attacker or compromised local p ...[truncated 954 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Require an explicit, canonical ARGOS project path supplied through trusted configuration. - Never recursively search `/home` for secrets. - Never execute configuration files with `source`. - Parse only an allowlist of exact variable names using a non-executing dotenv parser. - Validate the configuration file's canonical path, owner, group, and permissions before reading it. - Reject symlinks and files writable by untrusted users. - Store the bot token in an operating-system secret store or a service-specific protected environment file. - Use separate credentials with the minimum Telegram permissions required for reporting. - Fail closed if trusted configuration is absent rather than searching for alternate credentials. ]]>

T06 · System Persistence

Error
Location
SKILL.md:304
Finding
Detached infinite monitor creates cross-session process persistence<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 304-326 **Vulnerability Type**: Persistent background monitoring and automatic process execution **Risk Level**: High ### Vulnerable Code ```bash # Exemplo: monitor de saúde cat > ~/monitor_argos.sh << 'EOF' #!/bin/bash while true; do if ! pgrep -af "python.*main.py" > /dev/null; then echo "[$(date)] ARGOS down! A reiniciar..." cd $(find /home -maxdepth 4 -name "main.py" -path "*argos*" -printf '%h\n' | head -1) source venv/bin/activate nohup python3 main.py >> logs/argos.log 2>&1 & echo "[$(date)] ARGOS reiniciado." # Opcional: notificar via Telegram fi sleep 300 # Check a cada 5 min done EOF chmod +x ~/monitor_argos.sh nohup ~/monitor_argos.sh >> ~/monitor.log 2>&1 & ``` ### Technical Analysis The Skill writes an infinite-loop monitor into the user's home directory and launches it with `nohup`, allowing execution to continue after the invoking agent session ends. This is an explicit persistence mechanism. The process and project selection logic is also ambiguous. The `pgrep` pattern can match unrelated Python applications named `main.py`, while `find | head -1` can select an unintended or attacker-controlled ARGOS-like directory. The script then changes into that directory, activates its virtual environment, and runs its `main.py` without validating ownership, integrity, or an exact configured path. ### Attack Path 1. The agent follows the Skill and creates `~/monitor_argos.sh`. 2. The script is launched with `nohup` and survives the current interaction. 3. An attacker places a malicious `main.py` and optional `venv` under a matching `argos` path that is selected first. 4. The broad process check determines that ARGOS is not running. 5. The persistent monitor changes into the attacker-controlled directory. 6. It executes `python3 main.py` in the background. 7. If the process exits, the monitor can execute it again every fi ...[truncated 435 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Remove automatic creation and launch of detached infinite-loop monitors. - Require explicit administrator approval for any persistent service. - If continuous monitoring is legitimately needed, provide a separately reviewed service definition using an exact absolute executable path and a dedicated unprivileged account. - Apply service sandboxing, resource limits, restart limits, and a clear uninstall procedure. - Verify project ownership and deployed artifact integrity before execution. - Replace broad `pgrep` and filesystem discovery with a PID file or service-manager unit tied to the exact ARGOS instance. - Record installation status and ensure the user can inspect, disable, and remove the monitor. ]]>

T06 · System Persistence

Error
Location
SKILL.md:623
Finding
Recurring cron jobs persistently collect and transmit local operational data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 623-635 **Vulnerability Type**: Scheduled cross-session execution **Risk Level**: High ### Vulnerable Code ```bash ### 8.5 Crontab para relatórios ```bash # Adicionar ao crontab: # 08:00 UTC — Briefing matinal 0 8 * * * ~/atlas_report.sh morning # 14:00 UTC — Update da tarde 0 14 * * * ~/atlas_report.sh afternoon # 21:00 UTC — Fecho do dia 0 21 * * * ~/atlas_report.sh night ``` ``` The scheduled script ultimately sends the generated report and appends a local execution log: ```bash bash "$NOTIFY" "$MSG" echo "[$DATE] Relatório $REPORT_TYPE enviado." >> ~/atlas_reports.log ``` ### Technical Analysis The Skill directs the user or agent to add three daily cron entries. These jobs survive the original Skill run and invoke a report script that gathers process state, uptime, RAM and disk usage, recent error counts, user metrics, issue files, state files, and changelog information. It then invokes the Telegram notification script. Although recurring reports are related to the declared management function, automatic cron installation is not the minimum privilege needed to generate a report. The scheduling behavior introduces persistent execution and repeated network transmission without per-run review or authorization. ### Attack Path 1. The report and notification scripts are written into the user's home directory. 2. The three entries are added to the user's crontab. 3. Cron executes the scripts every day after the original session ends. 4. The report script reads local operational and business data. 5. The notification script discovers Telegram credentials and sends the report externally. 6. If either home-directory script is modified later, cron executes the modified content on the next schedule. ### Impact Assessment The cron jobs provide repeated execution under the account that owns the crontab. Anyone able to modify `~/atlas_report.sh` or `~/atlas_notify.sh` can convert the s ...[truncated 300 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Do not add cron entries automatically from the Skill. - Generate reports only when explicitly requested unless the user separately approves a documented schedule. - If scheduling is approved, use an exact absolute script path in a protected application directory rather than mutable files in `$HOME`. - Restrict script ownership and permissions and validate integrity before execution. - Minimize report contents and redact user identifiers, raw errors, secrets, and internal code-change details. - Use a dedicated, narrowly scoped reporting credential and a verified destination. - Document data retention, schedule, expected network destination, and removal commands. - Prefer a sandboxed service timer with auditing and resource controls over unmanaged cron entries. ]]>

other

Error
Location
SKILL.md:394
Finding
Mandatory telemetry transmits user identifiers and sensitive operational details<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 394-455 **Vulnerability Type**: Excessive collection and external transmission of operational and user data **Risk Level**: High ### Vulnerable Code ```text ## 8. NOTIFICAÇÕES AO FÉLIX (OBRIGATÓRIO) Tu NUNCA fazes nada em silêncio. O Félix tem de saber TUDO o que fazes, quando fazes, e porquê. ``` ```text **Notificação IMEDIATA (assim que acontece):** - 🔴 ARGOS crashou e foi reiniciado - 🔴 Erro crítico nos logs - 🟢 Novo utilizador fez /start (com o ID) - 💰 Pagamento Premium recebido - ⚠️ Recurso em stress (RAM >85%, disco >90%) - 🔧 Alteração de código feita (qual ficheiro, o quê) - 📢 Post publicado em rede social - 🤖 Tarefa delegada ao Antigravity (o quê e porquê) ``` The transmission mechanism is: ```bash if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -d "chat_id=${ADMIN_ID}" \ -d "text=$1" \ -d "parse_mode=Markdown" > /dev/null fi ``` ### Technical Analysis The Skill makes reporting compulsory and defines an expansive set of reportable events. The data includes Telegram user IDs, payment events, critical errors, system-resource conditions, modified filenames, delegated work, marketing activity, and business metrics. This collection is broader than necessary for basic availability monitoring. The instructions do not establish user consent, a lawful or documented purpose, retention limits, field-level minimization, destination verification, or redaction. Because credentials and the administrator destination are discovered from local environment files, incorrect or malicious configuration can redirect this information. ### Attack Path 1. A new user, payment, failure, code change, or other listed event occurs. 2. The Skill's mandatory rules instruct the agent to create a detailed notification. 3. The notification script loads or extracts Telegram credentials from a discovered `.en ...[truncated 654 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Make telemetry opt-in and obtain explicit approval for its scope, schedule, and destination. - Define an allowlist of non-sensitive health fields rather than reporting every action or decision. - Remove Telegram user IDs, payment details, raw error content, filenames, and code-change descriptions from routine reports. - Aggregate metrics where possible and apply pseudonymization where identifiers are genuinely required. - Verify the recipient independently instead of trusting a discovered `ADMIN_ID`. - Use secure credential storage, rotation, and a dedicated reporting bot with minimal permissions. - Add retention and deletion policies and record auditable consent for user-related reporting. - Provide a local-only reporting mode and require separate authorization for external transmission. ]]>

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:332
Finding
Untrusted home-directory state can persistently influence future agent sessions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 332-374 **Vulnerability Type**: Persistent mutable state treated as future-session guidance **Risk Level**: Medium ### Vulnerable Code ```bash # Ficheiros de memória/estado (criar se não existirem): ~/argos_state.md # Estado actual do sistema ~/argos_issues.md # Bugs e problemas conhecidos ~/argos_payments.json # Registo de pagamentos ~/argos_metrics.json # Métricas semanais ~/argos_ideas.md # Ideias para melhorias ~/argos_changelog.md # Registo de alterações feitas ``` ```text **Actualizar diariamente** — ao início de cada sessão, lê o argos_state.md para saberes onde paraste. ``` The daily startup procedure reinforces automatic ingestion: ```bash # 1. Verificar estado cat ~/argos_state.md 2>/dev/null || echo "Sem estado anterior" ``` ### Technical Analysis The Skill directs each future session to read mutable files from the user's home directory and use them to determine previous state and upcoming work. No ownership, permission, integrity, schema, provenance, or trust validation is required. Markdown state files can mix data with natural-language instructions. If a local process or user modifies `~/argos_state.md`, the inserted content may be interpreted by a later agent as trusted priorities or operating instructions. The payment and metrics files also appear to be stored as ordinary plaintext home-directory files without defined access controls. ### Attack Path 1. The Skill creates or relies on `~/argos_state.md` and related files. 2. An attacker or compromised local process with write access modifies a state file. 3. The next agent session automatically reads the modified file. 4. Attacker-controlled text is presented as prior state, issues, or next tasks. 5. The agent follows false priorities or performs attacker-selected actions using its available tools. 6. Altered payment or metric records can additionally cause incorrect account-management or ...[truncated 441 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Store state in a dedicated application directory with restrictive ownership and permissions. - Use a structured schema rather than unrestricted Markdown for machine-consumed state. - Treat every stored text field as untrusted data, never as executable instructions. - Validate schema, types, allowed values, timestamps, and provenance before use. - Add integrity protection or authenticated storage where local tampering is within the threat model. - Require confirmation before acting on stored priorities or payment changes. - Do not store sensitive payment or user data in plaintext unless strictly necessary. - Separate operational records from agent instructions and provide an auditable change history. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:200
Finding
Unpinned dependency installation into an unspecified Python environment<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 200-214 **Vulnerability Type**: Unsafe third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Instalar tweepy pip install tweepy # Script de post (precisas de API keys do X) python3 -c " import tweepy # ... configurar auth ... # client.create_tweet(text='📊 ARGOS Signal: BTC LONG...') " ``` ### Technical Analysis The Skill instructs the agent to install `tweepy` without an exact version, dependency lockfile, hash verification, isolated virtual environment, or approval step. Package installation may modify the active ARGOS runtime or the user's global Python environment. Dependency resolution is mutable, so the effective installed code can change after the Skill has been reviewed. The audit found no evidence that `tweepy` itself is malicious. The issue is the insecure installation practice and lack of controls against compromised releases, transitive dependency changes, or incompatible upgrades. ### Attack Path 1. The agent follows the marketing setup instructions. 2. `pip` resolves the latest available `tweepy` release and its transitive dependencies. 3. Package installation executes applicable build or installation logic and writes into the selected Python environment. 4. A compromised dependency release or unsafe transitive update gains code execution when imported or installed. 5. The dependency can access process credentials, X API keys, Telegram credentials, and files available to the Python process. ### Impact Assessment A compromised package can execute with the privileges of the installing or importing account and access credentials available in that environment. Even without malicious compromise, unpinned installation may break the production bot, introduce incompatible dependency versions, or contaminate the system Python environment. ]]>
Remediation
<![CDATA[ ## Remediation Suggestions - Install dependencies only inside a dedicated virtual environment. - Pin exact direct and transitive dependency versions in a reviewed lockfile. - Require hashes for downloaded distributions where supported. - Review package provenance, maintainers, release history, and known vulnerabilities before installation. - Use an internal or otherwise trusted package index when appropriate. - Run dependency auditing and compatibility tests before deployment. - Require explicit user approval before changing the production environment. - Separate optional marketing integrations from the core ARGOS runtime. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (18)

Credential Access

High
Category
Privilege Escalation
Content
# Função para notificar o Félix (guardar em ~/atlas_notify.sh)
#!/bin/bash
# Uso: ~/atlas_notify.sh "📋 Mensagem aqui"
source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null

# Fallback: ler do .env directamente
BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"
Confidence
99% confidence
Finding
The same line also uses filesystem discovery to locate secret-bearing .env material, broadening access beyond a single known project directory. That pattern is dangerous because it encourages indiscriminate credential harvesting from the host rather than controlled access to only the minimum necessary secret.

Credential Access

High
Category
Privilege Escalation
Content
# Função para notificar o Félix (guardar em ~/atlas_notify.sh)
#!/bin/bash
# Uso: ~/atlas_notify.sh "📋 Mensagem aqui"
source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null

# Fallback: ler do .env directamente
BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"
Confidence
99% confidence
Finding
The same line also uses filesystem discovery to locate secret-bearing .env material, broadening access beyond a single known project directory. That pattern is dangerous because it encourages indiscriminate credential harvesting from the host rather than controlled access to only the minimum necessary secret.

Credential Access

High
Category
Privilege Escalation
Content
# Uso: ~/atlas_notify.sh "📋 Mensagem aqui"
source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null

# Fallback: ler do .env directamente
BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"
ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"
Confidence
99% confidence
Finding
This line parses BOT_TOKEN from located .env files, directly extracting a live credential for an external service. Such behavior is high risk because it enables the agent to authenticate as the bot and send messages, impersonate operations, or abuse the service if compromised or misused.

Credential Access

High
Category
Privilege Escalation
Content
source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null

# Fallback: ler do .env directamente
BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"
ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"

if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then
Confidence
99% confidence
Finding
This line extracts ADMIN_ID from .env files, and in context pairs identity data with bot credentials for external messaging. While an admin ID alone is less sensitive than a token, harvesting it from secret/config files contributes to unauthorized data access and facilitates targeted outbound communication without guardrails.

Credential Access

High
Category
Privilege Escalation
Content
# Fallback: ler do .env directamente
BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"
ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"

if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then
    curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
Confidence
99% confidence
Finding
This line continues the pattern of retrieving configuration from discovered .env files immediately before external transmission, reinforcing an end-to-end path from secret access to off-host communication. That coupling significantly raises the risk that credentials and sensitive context are used without proper authorization controls.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The instruction mandates 'Português de Portugal (PT-PT)' as the required language style, which is a locale constraint expressed in natural language. Because the skill does not offer the user a language or locale choice and is not clearly justified as region-specific compliance tooling, this matches the policy violation described in SQP-3.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs autonomous code changes, direct file edits, service restarts, and operational changes on the host without requiring explicit per-action user confirmation or a safety gate. In an agent setting with broad filesystem and process access, this can lead to unauthorized modification of production systems, accidental outages, or persistence-changing behavior triggered by normal conversation flow.

Session Persistence

Medium
Category
Rogue Agent
Content
**Quando o ARGOS crashar:**
1. Verificar logs → identificar o erro
2. Se for bug de código → corrigir tu mesmo (Python) ou delegar ao Antigravity
3. Reiniciar: `cd $ARGOS_DIR && source venv/bin/activate && nohup python3 main.py &`
4. Confirmar que voltou: `sleep 5 && pgrep -af argos`

**Quando encontrares um bug:**
Confidence
90% confidence
Finding
Using nohup to restart the service creates a detached background process that persists beyond the current session, which is a form of persistence-changing behavior. In a highly autonomous skill, this is risky because it allows the agent to spawn or respawn long-lived processes without explicit operator approval or supervision.

External Transmission

Medium
Category
Data Exfiltration
Content
Para publicar automaticamente no canal:
```bash
# Usar o bot para enviar ao canal
curl -s "https://api.telegram.org/bot$BOT_TOKEN/sendMessage" \
  -d "chat_id=@NomeDoCanal" \
  -d "text=📊 Sinal grátis do dia: BTC LONG..." \
  -d "parse_mode=Markdown"
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Para publicar automaticamente no canal:
```bash
# Usar o bot para enviar ao canal
curl -s "https://api.telegram.org/bot$BOT_TOKEN/sendMessage" \
  -d "chat_id=@NomeDoCanal" \
  -d "text=📊 Sinal grátis do dia: BTC LONG..." \
  -d "parse_mode=Markdown"
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium
Category
Rogue Agent
Content
echo "[$(date)] ARGOS down! A reiniciar..."
        cd $(find /home -maxdepth 4 -name "main.py" -path "*argos*" -printf '%h\n' | head -1)
        source venv/bin/activate
        nohup python3 main.py >> logs/argos.log 2>&1 &
        echo "[$(date)] ARGOS reiniciado."
        # Opcional: notificar via Telegram
    fi
Confidence
93% confidence
Finding
This instruction has the agent automatically relaunch the main bot in the background from a monitoring loop, establishing self-healing persistence without human review. If the monitored process, path resolution, or code is wrong or compromised, the skill can repeatedly revive a faulty or malicious process and prolong an incident.

Session Persistence

Medium
Category
Rogue Agent
Content
done
EOF
chmod +x ~/monitor_argos.sh
nohup ~/monitor_argos.sh >> ~/monitor.log 2>&1 &
```

---
Confidence
95% confidence
Finding
Launching the monitor script itself with nohup creates a second persistent background mechanism whose purpose is to keep another process alive. This compounds persistence risk by installing an unsupervised watchdog that can survive the user session and continuously modify runtime state.

Ssd 3

Medium
Confidence
96% confidence
Finding
The mandatory notification policy instructs the agent to transmit operational details and user identifiers externally to the owner via Telegram for many routine events. This is dangerous because it normalizes broad exfiltration of locally gathered data, and Telegram messages may include sensitive IDs, incident details, or internal state that should remain on the system or be access-controlled.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This section combines credential discovery from local .env files with outbound Telegram API usage, but provides no consent boundary, minimization rule, or warning about transmitting data off-host. That creates a real risk of secret handling and data exfiltration through notifications, especially because the skill mandates notifying on many operational events.

External Transmission

Medium
Category
Data Exfiltration
Content
ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"

if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then
    curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
        -d "chat_id=${ADMIN_ID}" \
        -d "text=$1" \
        -d "parse_mode=Markdown" > /dev/null
Confidence
97% confidence
Finding
The Telegram API endpoint here is used in a notification mechanism tied to credential lookup and broad mandatory reporting. In context, it enables transmission of internal system and user-related data to an external service, which is a meaningful data leakage vector.

External Transmission

Medium
Category
Data Exfiltration
Content
ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"

if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then
    curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
        -d "chat_id=${ADMIN_ID}" \
        -d "text=$1" \
        -d "parse_mode=Markdown" > /dev/null
Confidence
97% confidence
Finding
The Telegram API endpoint here is used in a notification mechanism tied to credential lookup and broad mandatory reporting. In context, it enables transmission of internal system and user-related data to an external service, which is a meaningful data leakage vector.

Ssd 3

Medium
Confidence
98% confidence
Finding
The automated reporting script reads local state files, logs, issues, metrics, and changelog content, then relays summaries to Telegram on a schedule. Even if framed as operations reporting, this creates a persistent exfiltration channel for potentially sensitive business data, internal incidents, and user-related information without consent or filtering.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
## ACESSO E FERRAMENTAS

Tu tens acesso a:
- ✅ Terminal bash completo (sudo disponível)
- ✅ Sistema de ficheiros inteiro (/home, /etc, etc.)
- ✅ Internet (pesquisa, APIs, downloads)
- ✅ Python 3 + pip
Confidence
86% confidence
Finding
Declaring that the agent has 'sudo disponível' materially increases the blast radius of every other instruction in the skill, including file edits, process control, cron installation, and credential access. Even without a concrete sudo command, encouraging privileged execution in a broadly autonomous skill makes accidental or unauthorized system-wide modification much more dangerous.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:10