add-atomic-chat-tool
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting data from an external local model API.\n
- Ingestion points: The
atomic_chat_list_modelsandatomic_chat_generatetools inatomic-chat-mcp-stdio.tsreceive and return content from the local Atomic Chat API to the agent context.\n - Boundary markers: The skill does not use specific delimiters or instructions to prevent the agent from obeying instructions embedded in the external model's output.\n
- Capability inventory: The MCP server can perform network fetches to the local host and write status files to
/workspace/ipc/atomic_chat_status.json. It is configured to run as a sub-process via the agent runner.\n - Sanitization: The skill employs
zodfor validating tool input arguments.\n- [COMMAND_EXECUTION]: The skill modifies the coreindex.tsfile to register and execute a new MCP server as a sub-process using thebunruntime.\n- [PRIVILEGE_ESCALATION]: The skill modifiessrc/drivers/docker-driver.tsto elevate the logging level of specific container stderr lines containing the[ATOMIC]prefix fromdebugtoinfolevel.\n- [EXTERNAL_DOWNLOADS]: The skill documentation directs the user to download the Atomic Chat desktop application from its public GitHub repository release page.
Audit Metadata