atlas
Warn
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive browser profile data located in the macOS user Library directory.
- Evidence: Paths accessed include
~/Library/Application Support/com.openai.atlas/browser-data/host/and~/Library/Application Support/com.openai.atlas.beta/browser-data/host/. - Data accessed: Browser bookmarks and SQLite-based history databases.
- [COMMAND_EXECUTION]: The skill executes a local Python script through the
uvpackage manager, which could execute arbitrary code if the script or the local environment is compromised. - Evidence: Multiple instructions to run
uv run --python 3.12 python "$ATLAS_CLI"targeting a script located at$CODEX_HOME/skills/atlas/scripts/atlas_cli.py. - [PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection (Category 8).
- Ingestion points: The skill reads untrusted data from browser history and bookmarks (SKILL.md).
- Boundary markers: No delimiters or warnings are specified to prevent the agent from obeying instructions embedded in the ingested browser data.
- Capability inventory: The agent has capabilities to execute local scripts, open URLs, and manipulate browser tabs via AppleScript through the bundled CLI.
- Sanitization: No sanitization or filtering of the browser history or bookmark content is mentioned before processing.
Audit Metadata