atmos-plugins
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents how Atmos ingests metadata from external OCI registries during plugin discovery and installation. This represents a potential surface for indirect prompt injection if an attacker were to poison registry manifests. 1. Ingestion points: OCI registry metadata and plugin manifests (SKILL.md, references/policy.md). 2. Boundary markers: Atmos uses a lock file (.atmos.plugins.lock.yaml) to pin digests and prevent unauthorized updates. 3. Capability inventory: The tool installs and runs native binaries and writes to local cache/config. 4. Sanitization: The documentation describes mandatory signature enforcement and identity verification via the Atmos policy engine.
- [REMOTE_CODE_EXECUTION]: The Atmos CLI is designed to download and execute native Go binary plugins from remote OCI sources. This functionality is documented alongside security controls, such as requiring signatures from trusted publishers and using specific OCI registry identities. The skill provides guidance on implementing these policies to ensure only verified code is executed.
Audit Metadata