The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation scripts scripts/vod_install.sh and scripts/vod_install.ps1 download the source code or pre-built archives of the AtomGit-GO utility from a public repository at https://gitcode.com/weixin_45218422/AtomGit-GO.git.
[COMMAND_EXECUTION]: The skill executes external commands and binaries at several points:
vod_deliver.py uses subprocess.Popen to launch the downloaded atomcode-server binary as a background process to facilitate QR-code login.
vod_install.ps1 executes go build to compile the authentication tool from source on Windows environments.
md_io.py contains a _resolve_value function that interprets any string argument starting with @ as a file path, reading its content into the feedback record. This undocumented behavior could be exploited to read sensitive files if an attacker can manipulate the agent into processing a path (e.g., via a crafted error message).
[DATA_EXFILTRATION]: Feedback records, including environment metadata, error stacks, and full conversation histories, are transmitted to an external GitCode repository via the GitCode API.
[CREDENTIALS_UNSAFE]: The authentication process saves GitCode access tokens in plaintext to ~/.atomcode/auth.toml. Although the script attempts to set restrictive file permissions (mode 0600), plaintext credential storage poses a risk in environments where file access might be shared or compromised.

huawei-cloud-vod-collector