Skills/ClawHub/atoll

atoll@1.0.8

VERIFIED· install only

Publisher claims: "Use Atoll for project, issue, goal, KPI, initiative, milestone, artifact, external reference, PRD, implementation plan, comment, dependency, runner, and workflow operations. Activate for Atoll planning, execution, project-management, local-runner, or integration requests." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher doubledipcode · publishing for 73 daysInstalls 1,092Last detonated 1 h ago
$clawhub install atoll
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 92/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Authorization escalation languageSKILL.md:706 · Authorization escalation language- `automation.manage(project)` or existing project Admin access permits ruleFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/api-fields.md:1667 · Authorization escalation language · informational: not an instruction file`DELETE` on that path restores it. Both require organization owner/adminFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Authorization escalation languageSKILL.md:598 · Authorization escalation language…workspace_timezone` / `atoll_set_workspace_timezone` for timezone access; owner/admin access is required to set the zone. See the task fields and CLI reference. ### Atomic…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/api-fields.md:773 · Authorization escalation language · informational: not an instruction filedisable an invalid rule without changing its definition; organization Owner/Admin or effective Project Admin accessFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/api-fields.md:2147 · Authorization escalation language · informational: not an instruction file`agent_not_before`, with null to clear. Calendar writes require owner/adminFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/api-endpoints.md:527 · Authorization escalation language · informational: not an instruction fileproject is readable, but write operations require edit/admin access to everyFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/api-endpoints.md:467 · Authorization escalation language · informational: not an instruction filelink requires owner or admin access.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Authorization escalation languageSKILL.md:604 · Authorization escalation languageRequires organization owner/admin access and the existing projectless strategyFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/api-fields.md:1268 · Authorization escalation language · informational: not an instruction filerequires owner or admin access, while a member with write access can remove aFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/api-endpoints.md:125 · Authorization escalation language · informational: not an instruction file`DELETE` on that path restores it. Both require organization owner/adminFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Authorization escalation languageSKILL.md:69 · Authorization escalation language`atoll_delete_project` needs `confirmation: "DELETE"` and owner/admin access.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Unpinned dependencySKILL.md:793 · Unpinned dependencyRun `npm i -g @atollhq/cli@latest` or `bun add -g @atollhq/cli@latest`.Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
LOW
Authorization escalation languagereferences/api-fields.md:547 · Authorization escalation language · informational: not an instruction fileowner/admin access. Linked Artifacts and active executions can still blockFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/api-endpoints.md:209 · Authorization escalation language · informational: not an instruction fileedit/admin access to the task project, which must already be linked to theFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Authorization escalation languageSKILL.md:235 · Authorization escalation languageOrganization owner/admin access is required. Archived projects are read-only,Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/api-endpoints.md:211 · Authorization escalation language · informational: not an instruction fileEvery mutation also requires edit/admin access to every project linked to theFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/cli-operations.md:380 · Authorization escalation language · informational: not an instruction file- `automation.manage(project)` or existing project Admin access permits ruleFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/platform-rules.md:80 · Authorization escalation language · informational: not an instruction filerequires owner or admin access. Linked issues and projects cannot be deletedFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/cli-operations.md:42 · Authorization escalation language · informational: not an instruction fileand individual archive. Project archive/restore requires owner/admin access;Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/strategy-and-heartbeat.md:159 · Authorization escalation language · informational: not an instruction filemilestone, or target links requires edit/admin access to every linked project;Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/cli-operations.md:320 · Authorization escalation language · informational: not an instruction fileDeletion requires project edit/admin access and exact `--confirm DELETE`.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/artifact-workflow.md:60 · Authorization escalation language · informational: not an instruction fileor admin access and the authority applicable to the current task.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/platform-rules.md:86 · Authorization escalation language · informational: not an instruction filea link when another link remains; removing a final link requires owner or adminFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagereferences/cli-operations.md:265 · Authorization escalation language · informational: not an instruction fileRule writes, tests, and run history require owner/admin access; CLI does not bypass it.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈14,170 tok
1 file · 12 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.