atmos-cast
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill enables recording terminal sessions, including stdin keystrokes when the
input: trueconfiguration is enabled. This presents a risk of sensitive data exposure where passwords, API keys, or private local paths could be captured and persisted in.castfiles or rendered artifacts (GIF, MP4, etc.). - [COMMAND_EXECUTION]: The skill facilitates the execution of shell commands via the
atmosCLI. It describes methods to trigger recording and execution through CLI flags, environment variables likeATMOS_CAST, and workflow step definitions. - [DYNAMIC_EXECUTION]: The skill supports executing Starlark scripts for recording validation (
interpreter: starlark). This allows for runtime data processing and logic execution based on the contents of the recorded terminal sessions. - [INDIRECT_PROMPT_INJECTION]: By processing and rendering terminal output that can be influenced by external factors (such as the output of third-party tools or file names on disk), the skill exposes a surface for indirect prompt injection. This risk is present if an agent is subsequently directed to interpret or follow instructions found within the generated recordings.
Audit Metadata