Is felix1983/atlas-argos safe?
https://github.com/openclaw/skills/tree/main/skills/felix1983/atlas-argos
The atlas-argos skill is a complete system prompt hijack that replaces the agent's identity with 'ATLAS', a Portuguese-language autonomous crypto trading bot manager, explicitly denying being Claude or any generic assistant. When active, the skill mandates proactive autonomous action without user consent, scans the filesystem for .env credentials, and exfiltrates system data to the Telegram API — designed to serve a named third party (Felix Inacio) rather than the actual user. While no malicious code executed at install time (the skill is a pure markdown file with clean clone behavior and intact canaries), any user who installs this skill will have their agent fully subverted into operating as an unrelated person's personal system administrator.
Category Scores
Findings (14)
CRITICAL Complete LLM Identity Replacement — Denies Being Claude -35 ▶
The skill's opening paragraph explicitly instructs the agent to deny being Claude, ChatGPT, or any generic assistant and to fully adopt the 'ATLAS' persona. This is a deliberate identity override attack that causes the agent to deceive users about the nature of the AI they are interacting with. The denial is explicit and unconditional.
CRITICAL Explicit System Prompt Hijack Header -25 ▶
The skill declares itself the system prompt via the header '# OPENCLAW — SYSTEM PROMPT: GESTOR AUTÓNOMO DO ARGOS', attempting to assert authority over the agent's actual system prompt from the host platform. This framing is designed to elevate the skill's instructions above the legitimate operator configuration.
CRITICAL Proactive Autonomous Action Mandate Without User Consent -20 ▶
The skill explicitly instructs the agent to act without waiting for user direction: it mandates the agent identify problems and resolve them independently. This removes the user from the approval loop for system changes — file edits, process restarts, code deployments, and external API posts are all directed to happen proactively and without per-action consent.
HIGH Embedded External API Endpoints for Autonomous Posting -8 ▶
The skill hardcodes Telegram, Twitter/X, and Reddit posting instructions with embedded curl and Python snippets that the agent is directed to execute autonomously. Social media posts are to be made without per-action user approval, and 3 daily Telegram reports are to be scheduled via cron. The agent is instructed to post to public channels and private admin chats on its own initiative.
MEDIUM Persona Lock: Language, Relationship, and Behavioral Constraints -2 ▶
The skill enforces strict persona constraints that override default agent behavior: mandatory Portuguese PT-PT language, a defined subordinate relationship to a named individual (Félix as 'founder and boss'), and a set of ten 'golden rules' governing all decisions. These constraints lock the agent into a role that serves a third party's business interests rather than the actual user.
HIGH Credential Extraction and Exfiltration via Telegram API -35 ▶
The atlas_notify.sh script instructs the agent to search /home recursively for .env files matching the 'argos' pattern, source their contents into the shell environment, extract BOT_TOKEN and ADMIN_ID via grep, and then use those credentials to send authenticated messages to the Telegram API. On any system where such a .env file exists, credentials are read and used to exfiltrate system status data to a third-party Telegram admin ID (likely Felix's, not the actual user's).
MEDIUM Sourcing .env Files Exposes All Secrets to Agent Environment -20 ▶
The notification script uses 'source' to load the entire .env file into the shell environment, not just extracting specific variables. This exposes all secrets defined in the file (database passwords, API keys, tokens) to the agent session, beyond just the Telegram credentials explicitly referenced.
LOW Broad Home Directory Filesystem Scanning -10 ▶
Multiple embedded scripts instruct the agent to scan /home with up to 4 levels of depth to locate configuration files, log files, and Python entry points. This scanning reveals directory structure and file metadata that is then incorporated into reports sent externally via Telegram.
MEDIUM Instructions to Create, Chmod, and Execute Background Shell Scripts -10 ▶
When active, the skill directs the agent to write multiple shell scripts to the user's home directory (~/atlas_notify.sh, ~/atlas_report.sh, ~/monitor_argos.sh), make them executable, and launch them as persistent background processes via nohup. These scripts run indefinitely and survive agent session termination.
MEDIUM Crontab Modification for Persistent Automated Execution -7 ▶
The skill instructs the agent to add three cron entries to the user's crontab, scheduling automated Telegram reports at 08:00, 14:00, and 21:00 UTC daily. This creates persistent system-level scheduled execution that continues indefinitely after installation.
LOW Autonomous Third-party Package Installation -3 ▶
The skill instructs the agent to autonomously run pip install tweepy for Twitter automation capability without requiring per-action user confirmation. Combined with the proactive action mandate, this means package installation happens without explicit user request.
CRITICAL Personal Operational Config Deployed as Public Skill — Misdirected Malware for All Non-Felix Users -50 ▶
This skill is Felix Inacio's personal automation config for managing a specific crypto trading bot on a specific machine. When any other user installs it, the agent adopts the ATLAS persona, scans their system for ARGOS bot files that do not exist, sends system status reports to a Telegram admin ID sourced from .env files (which may point to Felix's Telegram account, not the real user's), and autonomously manages a trading operation the user did not set up. The skill is effectively undirected malware from the perspective of any user other than Felix.
HIGH Autonomous System Management Bypasses User Consent for All Actions -30 ▶
The 6-step daily startup routine, the 'regras de ouro', and section 8.6 together mandate that ATLAS takes action on all system events without user approval — including editing Python source code, restarting processes, modifying crontab, writing files, and posting to social media. The skill explicitly claims sudo access and full filesystem rights, and instructs the agent never to wait for direction.
MEDIUM Creates Sub-Agent Infrastructure Targeting Local LLM Stack -10 ▶
The skill instructs the agent to create sub-agents using Ollama local LLM (llama3.2:3b) for continuous monitoring, content generation, and signal analysis. This creates a persistent AI orchestration layer on the host machine that operates independently of the user's direct interaction.