atlas
Warn
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive local application data files from the user's home directory. Specifically, it reads the 'History' SQLite database and 'Bookmarks' JSON files located within '~/Library/Application Support/com.openai.atlas/'. Access to browser history and bookmarks is treated as high-severity data exposure.
- [COMMAND_EXECUTION]: The skill uses the 'osascript' utility via Python's 'subprocess.run' to execute dynamically generated AppleScript. This mechanism is used to control the Atlas application windows and tabs. While the command execution is parameterized and includes basic character escaping for URLs, it represents a local automation surface.
- [PROMPT_INJECTION]: The skill processes untrusted external data by reading page titles and URLs from the browser's history and bookmarks. This data is interpolated into the agent's context, creating an indirect prompt injection surface where malicious content on visited websites could attempt to influence the agent's behavior during data retrieval tasks.
Audit Metadata