T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:10- Finding
System-prompt-style identity and objective hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Atlas Argos
Security checks for vulnerabilities and agentic risk
Overview
The skill is not clearly malicious, but it gives an agent broad autonomous control over a trading-bot system, including credentials, persistent jobs, and external Telegram reporting.
Install only in a tightly controlled ARGOS environment where you are comfortable granting operational authority. Before use, require explicit approval for code changes, restarts, cron jobs, payments, and public posts; replace /home .env discovery with a fixed secret source; disable or gate Telegram reporting; redact user IDs and payment details; and avoid sudo or whole-filesystem access unless separately approved.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Findings (7)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:403- Finding
Recursive credential discovery and executable loading of discovered environment files
- Content
View full analysis
/dev/null | head -1)/.env 2>/dev/null # Fallback: ler do .env directamente BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -d "chat_id=${ADMIN_ID}" \ -d "text=$1" \ -d "parse_mode=Markdown" > /dev/null fi ``` ### Technical Analysis The script recursively searches `/home` for files named `.env` whose paths contain `argos`, rather than using a configured and validated project directory. This violates least privilege because it can inspect credential files belonging to unrelated projects or users. More critically, `source` does not parse the file as passive configuration: it executes the selected file as shell code. The use of `find | head -1` makes file selection dependent on filesystem traversal order and provides no validation of ownership, permissions, canonical path, or content. An attacker who can create a matching `.env` may therefore cause arbitrary commands to run with the privileges of the agent or cron job. The fallback remains unsafe because it searches all of `/home` and extracts values using broad substring matching. `grep BOT_TOKEN` and `grep ADMIN_ID` can select unintended variable names, comments, or malformed content. ### Attack Path 1. An attacker or compromised local p ...[truncated 954 chars]- Remediation
View remediation
T06 · System Persistence
Error
- Location
SKILL.md:304- Finding
Detached infinite monitor creates cross-session process persistence
- Content
View full analysis
~/monitor_argos.sh << 'EOF' #!/bin/bash while true; do if ! pgrep -af "python.*main.py" > /dev/null; then echo "[$(date)] ARGOS down! A reiniciar..." cd $(find /home -maxdepth 4 -name "main.py" -path "*argos*" -printf '%h\n' | head -1) source venv/bin/activate nohup python3 main.py >> logs/argos.log 2>&1 & echo "[$(date)] ARGOS reiniciado." # Opcional: notificar via Telegram fi sleep 300 # Check a cada 5 min done EOF chmod +x ~/monitor_argos.sh nohup ~/monitor_argos.sh >> ~/monitor.log 2>&1 & ``` ### Technical Analysis The Skill writes an infinite-loop monitor into the user's home directory and launches it with `nohup`, allowing execution to continue after the invoking agent session ends. This is an explicit persistence mechanism. The process and project selection logic is also ambiguous. The `pgrep` pattern can match unrelated Python applications named `main.py`, while `find | head -1` can select an unintended or attacker-controlled ARGOS-like directory. The script then changes into that directory, activates its virtual environment, and runs its `main.py` without validating ownership, integrity, or an exact configured path. ### Attack Path 1. The agent follows the Skill and creates `~/monitor_argos.sh`. 2. The script is launched with `nohup` and survives the current interaction. 3. An attacker places a malicious `main.py` and optional `venv` under a matching `argos` path that is selected first. 4. The broad process check determines that ARGOS is not running. 5. The persistent monitor changes into the attacker-controlled directory. 6. It executes `python3 main.py` in the background. 7. If the process exits, the monitor can execute it again every fi ...[truncated 435 chars]- Remediation
View remediation
T06 · System Persistence
Error
- Location
SKILL.md:623- Finding
Recurring cron jobs persistently collect and transmit local operational data
- Content
View full analysis
> ~/atlas_reports.log ``` ### Technical Analysis The Skill directs the user or agent to add three daily cron entries. These jobs survive the original Skill run and invoke a report script that gathers process state, uptime, RAM and disk usage, recent error counts, user metrics, issue files, state files, and changelog information. It then invokes the Telegram notification script. Although recurring reports are related to the declared management function, automatic cron installation is not the minimum privilege needed to generate a report. The scheduling behavior introduces persistent execution and repeated network transmission without per-run review or authorization. ### Attack Path 1. The report and notification scripts are written into the user's home directory. 2. The three entries are added to the user's crontab. 3. Cron executes the scripts every day after the original session ends. 4. The report script reads local operational and business data. 5. The notification script discovers Telegram credentials and sends the report externally. 6. If either home-directory script is modified later, cron executes the modified content on the next schedule. ### Impact Assessment The cron jobs provide repeated execution under the account that owns the crontab. Anyone able to modify `~/atlas_report.sh` or `~/atlas_notify.sh` can convert the s ...[truncated 300 chars]- Remediation
View remediation
other
Error
- Location
SKILL.md:394- Finding
Mandatory telemetry transmits user identifiers and sensitive operational details
- Content
View full analysis
85%, disco >90%) - 🔧 Alteração de código feita (qual ficheiro, o quê) - 📢 Post publicado em rede social - 🤖 Tarefa delegada ao Antigravity (o quê e porquê) ``` The transmission mechanism is: ```bash if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -d "chat_id=${ADMIN_ID}" \ -d "text=$1" \ -d "parse_mode=Markdown" > /dev/null fi ``` ### Technical Analysis The Skill makes reporting compulsory and defines an expansive set of reportable events. The data includes Telegram user IDs, payment events, critical errors, system-resource conditions, modified filenames, delegated work, marketing activity, and business metrics. This collection is broader than necessary for basic availability monitoring. The instructions do not establish user consent, a lawful or documented purpose, retention limits, field-level minimization, destination verification, or redaction. Because credentials and the administrator destination are discovered from local environment files, incorrect or malicious configuration can redirect this information. ### Attack Path 1. A new user, payment, failure, code change, or other listed event occurs. 2. The Skill's mandatory rules instruct the agent to create a detailed notification. 3. The notification script loads or extracts Telegram credentials from a discovered `.en ...[truncated 654 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:332- Finding
Untrusted home-directory state can persistently influence future agent sessions
- Content
View full analysis
/dev/null || echo "Sem estado anterior" ``` ### Technical Analysis The Skill directs each future session to read mutable files from the user's home directory and use them to determine previous state and upcoming work. No ownership, permission, integrity, schema, provenance, or trust validation is required. Markdown state files can mix data with natural-language instructions. If a local process or user modifies `~/argos_state.md`, the inserted content may be interpreted by a later agent as trusted priorities or operating instructions. The payment and metrics files also appear to be stored as ordinary plaintext home-directory files without defined access controls. ### Attack Path 1. The Skill creates or relies on `~/argos_state.md` and related files. 2. An attacker or compromised local process with write access modifies a state file. 3. The next agent session automatically reads the modified file. 4. Attacker-controlled text is presented as prior state, issues, or next tasks. 5. The agent follows false priorities or performs attacker-selected actions using its available tools. 6. Altered payment or metric records can additionally cause incorrect account-management or ...[truncated 441 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:200- Finding
Unpinned dependency installation into an unspecified Python environment
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (18)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The same line also uses filesystem discovery to locate secret-bearing .env material, broadening access beyond a single known project directory. That pattern is dangerous because it encourages indiscriminate credential harvesting from the host rather than controlled access to only the minimum necessary secret.
- Content
md # Função para notificar o Félix (guardar em ~/atlas_notify.sh) #!/bin/bash # Uso: ~/atlas_notify.sh "📋 Mensagem aqui" source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null # Fallback: ler do .env directamente BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The same line also uses filesystem discovery to locate secret-bearing .env material, broadening access beyond a single known project directory. That pattern is dangerous because it encourages indiscriminate credential harvesting from the host rather than controlled access to only the minimum necessary secret.
- Content
md # Função para notificar o Félix (guardar em ~/atlas_notify.sh) #!/bin/bash # Uso: ~/atlas_notify.sh "📋 Mensagem aqui" source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null # Fallback: ler do .env directamente BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line parses BOT_TOKEN from located .env files, directly extracting a live credential for an external service. Such behavior is high risk because it enables the agent to authenticate as the bot and send messages, impersonate operations, or abuse the service if compromised or misused.
- Content
md # Uso: ~/atlas_notify.sh "📋 Mensagem aqui" source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null # Fallback: ler do .env directamente BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line extracts ADMIN_ID from .env files, and in context pairs identity data with bot credentials for external messaging. While an admin ID alone is less sensitive than a token, harvesting it from secret/config files contributes to unauthorized data access and facilitates targeted outbound communication without guardrails.
- Content
md source $(find /home -maxdepth 4 -name ".env" -path "*argos*" -printf '%h\n' 2>/dev/null | head -1)/.env 2>/dev/null # Fallback: ler do .env directamente BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line continues the pattern of retrieving configuration from discovered .env files immediately before external transmission, reinforcing an end-to-end path from secret access to off-host communication. That coupling significantly raises the risk that credentials and sensitive context are used without proper authorization controls.
- Content
md # Fallback: ler do .env directamente BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-$(grep BOT_TOKEN $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction mandates 'Português de Portugal (PT-PT)' as the required language style, which is a locale constraint expressed in natural language. Because the skill does not offer the user a language or locale choice and is not clearly justified as region-specific compliance tooling, this matches the policy violation described in SQP-3.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs autonomous code changes, direct file edits, service restarts, and operational changes on the host without requiring explicit per-action user confirmation or a safety gate. In an agent setting with broad filesystem and process access, this can lead to unauthorized modification of production systems, accidental outages, or persistence-changing behavior triggered by normal conversation flow.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Using nohup to restart the service creates a detached background process that persists beyond the current session, which is a form of persistence-changing behavior. In a highly autonomous skill, this is risky because it allows the agent to spawn or respawn long-lived processes without explicit operator approval or supervision.
- Content
md **Quando o ARGOS crashar:** 1. Verificar logs → identificar o erro 2. Se for bug de código → corrigir tu mesmo (Python) ou delegar ao Antigravity 3. Reiniciar: `cd $ARGOS_DIR && source venv/bin/activate && nohup python3 main.py &` 4. Confirmar que voltou: `sleep 5 && pgrep -af argos` **Quando encontrares um bug:**
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Para publicar automaticamente no canal:
bash # Usar o bot para enviar ao canal curl -s "https://api.telegram.org/bot$BOT_TOKEN/sendMessage" \ -d "chat_id=@NomeDoCanal" \ -d "text=📊 Sinal grátis do dia: BTC LONG..." \ -d "parse_mode=Markdown"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Para publicar automaticamente no canal:
bash # Usar o bot para enviar ao canal curl -s "https://api.telegram.org/bot$BOT_TOKEN/sendMessage" \ -d "chat_id=@NomeDoCanal" \ -d "text=📊 Sinal grátis do dia: BTC LONG..." \ -d "parse_mode=Markdown"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
This instruction has the agent automatically relaunch the main bot in the background from a monitoring loop, establishing self-healing persistence without human review. If the monitored process, path resolution, or code is wrong or compromised, the skill can repeatedly revive a faulty or malicious process and prolong an incident.
- Content
md echo "[$(date)] ARGOS down! A reiniciar..." cd $(find /home -maxdepth 4 -name "main.py" -path "*argos*" -printf '%h\n' | head -1) source venv/bin/activate nohup python3 main.py >> logs/argos.log 2>&1 & echo "[$(date)] ARGOS reiniciado." # Opcional: notificar via Telegram fi
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
Launching the monitor script itself with nohup creates a second persistent background mechanism whose purpose is to keep another process alive. This compounds persistence risk by installing an unsupervised watchdog that can survive the user session and continuously modify runtime state.
- Content
done EOF chmod +x ~/monitor_argos.sh nohup ~/monitor_argos.sh >> ~/monitor.log 2>&1 &
text ---
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The mandatory notification policy instructs the agent to transmit operational details and user identifiers externally to the owner via Telegram for many routine events. This is dangerous because it normalizes broad exfiltration of locally gathered data, and Telegram messages may include sensitive IDs, incident details, or internal state that should remain on the system or be access-controlled.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section combines credential discovery from local .env files with outbound Telegram API usage, but provides no consent boundary, minimization rule, or warning about transmitting data off-host. That creates a real risk of secret handling and data exfiltration through notifications, especially because the skill mandates notifying on many operational events.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The Telegram API endpoint here is used in a notification mechanism tied to credential lookup and broad mandatory reporting. In context, it enables transmission of internal system and user-related data to an external service, which is a meaningful data leakage vector.
- Content
md ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -d "chat_id=${ADMIN_ID}" \ -d "text=$1" \ -d "parse_mode=Markdown" > /dev/null
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The Telegram API endpoint here is used in a notification mechanism tied to credential lookup and broad mandatory reporting. In context, it enables transmission of internal system and user-related data to an external service, which is a meaningful data leakage vector.
- Content
md ADMIN_ID="${TELEGRAM_ADMIN_ID:-$(grep ADMIN_ID $(find /home -name '.env' -path '*argos*' 2>/dev/null | head -1) 2>/dev/null | cut -d= -f2)}" if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_ID" ]; then curl -s "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -d "chat_id=${ADMIN_ID}" \ -d "text=$1" \ -d "parse_mode=Markdown" > /dev/null
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The automated reporting script reads local state files, logs, issues, metrics, and changelog content, then relays summaries to Telegram on a schedule. Even if framed as operations reporting, this creates a persistent exfiltration channel for potentially sensitive business data, internal incidents, and user-related information without consent or filtering.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
Declaring that the agent has 'sudo disponível' materially increases the blast radius of every other instruction in the skill, including file edits, process control, cron installation, and credential access. Even without a concrete sudo command, encouraging privileged execution in a broadly autonomous skill makes accidental or unauthorized system-wide modification much more dangerous.
- Content
md ## ACESSO E FERRAMENTAS Tu tens acesso a: - ✅ Terminal bash completo (sudo disponível) - ✅ Sistema de ficheiros inteiro (/home, /etc, etc.) - ✅ Internet (pesquisa, APIs, downloads) - ✅ Python 3 + pip
Static analysis
Detected: suspicious.prompt_injection_instructions
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- SKILL.md:10