The Agent Skills Directory

Data Exposure & Exfiltration (HIGH): The skill accesses highly sensitive user data by reading the browser's History (SQLite) and Bookmarks (JSON) files located in the ~/Library/Application Support/com.openai.atlas/ directory.
Evidence: LOCAL_STATE_PATH, get_history_path(), and get_bookmarks_path() in scripts/atlas_common.py target known sensitive browser profile paths.
Command Execution (MEDIUM): The skill executes system-level commands using the osascript utility to control the Atlas application through AppleScript.
Evidence: The run_applescript and _run_applescript_raw functions in scripts/atlas_common.py use subprocess.run to call osascript with dynamically generated script strings.
Indirect Prompt Injection (LOW): The skill ingests untrusted data from browser history and bookmarks, which could contain malicious instructions designed to influence the agent's behavior when processed.
Ingestion points: Browser History and Bookmarks files read in scripts/atlas_common.py.
Boundary markers: Absent; no delimiters or instructions are used to separate user data from control logic.
Capability inventory: Includes osascript execution (system control) and file read access.
Sanitization: Absent; no evidence of data escaping or validation for content retrieved from browser history.
Dynamic Execution (MEDIUM): The skill dynamically constructs and executes AppleScript code at runtime, which is a form of executable content generation.
Evidence: The tell_atlas function in scripts/atlas_common.py wraps arbitrary script bodies into application-specific AppleScript blocks.

atlas