add-atomic-chat-tool

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting data from an external local model API.\n
  • Ingestion points: The atomic_chat_list_models and atomic_chat_generate tools in atomic-chat-mcp-stdio.ts receive and return content from the local Atomic Chat API to the agent context.\n
  • Boundary markers: The skill does not use specific delimiters or instructions to prevent the agent from obeying instructions embedded in the external model's output.\n
  • Capability inventory: The MCP server can perform network fetches to the local host and write status files to /workspace/ipc/atomic_chat_status.json. It is configured to run as a sub-process via the agent runner.\n
  • Sanitization: The skill employs zod for validating tool input arguments.\n- [COMMAND_EXECUTION]: The skill modifies the core index.ts file to register and execute a new MCP server as a sub-process using the bun runtime.\n- [PRIVILEGE_ESCALATION]: The skill modifies src/drivers/docker-driver.ts to elevate the logging level of specific container stderr lines containing the [ATOMIC] prefix from debug to info level.\n- [EXTERNAL_DOWNLOADS]: The skill documentation directs the user to download the Atomic Chat desktop application from its public GitHub repository release page.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 02:01 AM
Security Audit — agent-trust-hub — add-atomic-chat-tool