Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Atlas Cloud mature-video generation skill that uses an API key and sends prompts or media to Atlas, with no evidence of hidden persistence, deception, or malicious behavior.
Install only if you intend to use Atlas Cloud for adult video generation. Use a dedicated Atlas Cloud API key, keep account balance limited, confirm users are 18+, upload only media you have rights and consent to use, and assume prompts/media sent to Atlas Cloud are visible to that service.
The skill explicitly requires environment access for ATLASCLOUD_API_KEY and documents outbound network calls to a third-party API, but it does not declare any permissions or allowed-tools scope. That mismatch weakens least-privilege controls and makes it harder for a host agent to constrain what the skill may access or where data may be sent.
The skill states that the agent MUST confirm the user is 18+ before first use, but the later implementation workflow does not require or enforce that check before execution. Because this skill is specifically designed for NSFW generation, failure to enforce gating materially increases the risk of prohibited use by minors and policy noncompliance.
The skill sends prompts and media references to an external service and includes the API key in an Authorization header, which is a real data-exposure boundary. In context this is expected functionality rather than overtly malicious behavior, but it still creates privacy, compliance, and billing risk because user inputs and account-backed credentials are transmitted to a third party.
# Step 1: Submit — replace {PAYLOAD} with the model-specific JSON below
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
-H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
-H "Content-Type: application/json" \
-d '{PAYLOAD}'
The skill sends prompts and media references to an external service and includes the API key in an Authorization header, which is a real data-exposure boundary. In context this is expected functionality rather than overtly malicious behavior, but it still creates privacy, compliance, and billing risk because user inputs and account-backed credentials are transmitted to a third party.
# Step 1: Submit — replace {PAYLOAD} with the model-specific JSON below
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
-H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
-H "Content-Type: application/json" \
-d '{PAYLOAD}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.error
import urllib.parse
API_BASE = "https://api.atlascloud.ai/api/v1"
def get_api_key():
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.error
import urllib.parse
API_BASE = "https://api.atlascloud.ai/api/v1"
def get_api_key():
No suspicious patterns detected.