Atomcode Delegation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.1

Overview

This skill is coherent for delegating coding work to AtomCode, but it repeatedly encourages unattended code-modifying runs and uses shared temporary files without enough containment guidance.

Install only if you are comfortable with AtomCode making repository changes in unattended mode. Run it in a clean branch, disposable worktree, container, or low-privilege account; avoid putting secrets in prompts or logs; use private temp directories instead of shared `/tmp`; and review `git diff` before keeping any changes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:27

Finding

Unattended Agent Execution Bypasses Permission Confirmation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:27-31, with repeated usage at SKILL.md:38, SKILL.md:111-115, and SKILL.md:252-254
Vulnerability Type: Unattended execution without per-action authorization
Risk Level: High

Vulnerable Code

bash

atomcode -C "<workdir>" \
  --prompt-file "<prompt_file>" \
  -y \
  --provider "<provider>" \
  --max-turns <N>

The documented parameter behavior explicitly states:

text

| `-y` | Required | Skip permission confirmation (mandatory for background tasks, otherwise they hang) |

The same option is used in the single-task execution flow:

bash

atomcode -C "<workdir>" \
  --prompt-file "/tmp/prompts/<task_id>.txt" \
  -y --dev \
  --provider AtomGit-deepseek-v4-flash \
  --max-turns 12 \
  > "$LOG" 2>&1 &
ATOMCODE_PID=$!

Technical Analysis

The Skill instructs users or agents to run AtomCode with -y, which disables permission confirmation while granting the delegated agent access to the selected working directory. The command does not apply a restrictive tool policy, despite documenting the availability of --disable-tools.

Consequently, actions requested by the model can occur without interactive review. If task instructions, prompt files, repository content, or other model-visible context contain malicious or misleading instructions, the delegated process may modify files or invoke available tools under the permissions of the account running AtomCode.

This does not elevate the operating-system account beyond its existing privileges. However, it removes an authorization boundary and can permit actions beyond the legitimate scope of the delegated coding task.

Attack Path

1. An attacker influences a task prompt, prompt file, issue description, repository file, or other content processed by AtomCode.
2. The Skill launches AtomCode with -y, suppressing p ...[truncated 891 chars]

Remediation

View remediation

Remediation Suggestions

• Do not make -y the default execution mode. Require interactive approval for sensitive filesystem, shell, network, and credential-related actions.
• If unattended execution is necessary, run AtomCode inside a disposable container, sandbox, or restricted virtual machine.
• Use a dedicated Git worktree containing only the files required for the task.
• Run the process under a low-privilege account with no access to SSH keys, cloud credentials, browser profiles, or unrelated repositories.
• Explicitly disable unnecessary tools with --disable-tools, or use an allowlist if AtomCode supports one.
• Mount the target repository as read-only where possible and apply reviewed patches separately.
• Validate and review git diff before merging or executing any generated code.
• Treat repository content and externally sourced task descriptions as untrusted input.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:19

Finding

Predictable Shared Temporary Files Permit Symlink Attacks and Information Disclosure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19, SKILL.md:68-83, SKILL.md:110-131, and SKILL.md:241-266; corresponding examples also appear at README.md:29-39 and README.md:50-58
Vulnerability Type: Unsafe predictable temporary files
Risk Level: Medium

Vulnerable Code

bash

command -v atomcode >/dev/null 2>&1 || { echo "ERROR: atomcode not found in PATH"; exit 1; }
mkdir -p /tmp/atomcode-tasks /tmp/prompts

Prompts are written to predictable names inside the shared directory:

bash

cat > "/tmp/prompts/<task_id>.txt" << 'PROMPT'
# Task title
## Background
Problem description, affected code locations, expected behavior versus actual behavior.
## Modification requirements
1. Read the relevant files before making changes
2. Specify the required changes
3. Preserve the existing code style and comments
PROMPT

if [ ! -s "/tmp/prompts/<task_id>.txt" ]; then
  echo "ERROR: prompt file is empty or was not written"; exit 1
fi

Logs are likewise created through ordinary shell redirection:

bash

LOG="/tmp/atomcode-tasks/<task_id>.log"
atomcode -C "<workdir>" \
  --prompt-file "/tmp/prompts/<task_id>.txt" \
  -y --dev \
  --provider AtomGit-deepseek-v4-flash \
  --max-turns 12 \
  > "$LOG" 2>&1 &
ATOMCODE_PID=$!

Technical Analysis

The Skill uses globally predictable directories and filenames under /tmp without creating a private, randomly named directory. It does not set a restrictive umask, verify directory ownership, reject symbolic links, or create files with exclusive semantics.

On a multi-user system, another local user may create /tmp/prompts, /tmp/atomcode-tasks, or expected task files before the victim runs the documented commands. Standard shell redirection follows symbolic links. A pre-positioned link can therefore redirect prompt or log output to another file wr ...[truncated 1650 chars]

Remediation

View remediation

Remediation Suggestions

• Create a private temporary directory with mktemp -d, for example:

  bash

  umask 077
  TASK_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/atomcode.XXXXXXXX")" || exit 1
  PROMPT_DIR="$TASK_ROOT/prompts"
  LOG_DIR="$TASK_ROOT/logs"
  mkdir -m 700 "$PROMPT_DIR" "$LOG_DIR"
  trap 'rm -rf -- "$TASK_ROOT"' EXIT
  

• Ensure every temporary directory is owned by the current user and has mode 0700.

• Create sensitive files with restrictive permissions such as 0600.

• Use exclusive file creation or descriptors configured to reject pre-existing files.

• Reject symbolic links and verify files with lstat or equivalent checks before reading or writing.

• Validate task identifiers against a strict allowlist such as ^[A-Za-z0-9_-]+$.

• Do not place secrets, credentials, or unnecessary source contents in prompt and log files.

• Apply the same private-directory pattern to all README and SKILL examples so users do not copy insecure commands.

• Clean up the entire private temporary directory after the task, including on interruption or failure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

md

- **PID 追踪**: 始终保存 `$!`，不用 `pgrep` 子串匹配
- **引号保护**: 所有路径变量用双引号包裹
- **超时守护**: 后台任务务必配超时
- **清理**: `rm -f /tmp/atomcode-tasks/<task_id>.log /tmp/prompts/<task_id>.txt`

## End-to-End 示例

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly demonstrates unattended code-modifying execution using auto-approval flags (-y --dev) and backgrounded batch runs, but it does not warn that the delegated agent may edit files, consume repository state, or that timeout/watchdog logic may terminate processes mid-task. In the context of a delegation skill whose purpose is to let an external coding agent act headlessly on a local project, this omission materially increases the chance of unsafe or unintended repository changes and partial writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill stores prompts and task logs in /tmp, and those artifacts may contain source code, bug descriptions, paths, and other sensitive context. On shared or multi-user systems, /tmp is a common location for unintended exposure, and the documentation does not warn about confidentiality or recommend secure permissions and cleanup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs use of atomcode with -y, which suppresses permission confirmation while allowing unattended code changes. In this skill’s context, that increases the chance of silent or unintended file modification if the prompt, working directory, or delegated task is broader than expected, especially when run in the background.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language instructions, headings, and operational guidance are presented only in Chinese, which effectively forces a specific language for users. The file does not indicate that the skill is region-specific or provide an alternative language or opt-in choice, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This skill's description and instructions are presented in Chinese, but the file does not indicate that the language is optional, user-selected, or required for a region-specific reason.

Content

No source excerpt is available for this finding.