AAS Core is a local control plane for coding agents that lets them search a large catalogue of skills, choose a stack, validate it, and create a reproducible plan. It is used to assemble and review agent workflows through its CLI, local MCP server, catalogue, plugins, and Workbench. The catalogue add-ons provide the skills, plugins, bundles, and workflows that AAS Core helps agents select and validate.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sickn33/agentic-awesome-skills --skill atlas-cloud-mediagit clone --depth 1 https://github.com/sickn33/agentic-awesome-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sickn33/agentic-awesome-skills/atlas-cloud-media)<a href="https://agentmods.dev/skills/sickn33/agentic-awesome-skills/atlas-cloud-media"><img src="https://agentmods.dev/badge/skills/sickn33/agentic-awesome-skills/atlas-cloud-media/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sickn33/agentic-awesome-skills/atlas-cloud-media"><img src="https://agentmods.dev/badge/skills/sickn33/agentic-awesome-skills/atlas-cloud-media.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 13 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Privilege Escalation · line 9 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Excessive Agency · line 39 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Data Exfiltration · line 48 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 49 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 50 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 51 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 91 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 114 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 139 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 163 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Privilege Escalation · line 76 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Data Exfiltration · line 112 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Privilege Escalation · line 211 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.02671 |
| Opus 5.5 | $0.00010 | $0.01068 |
| Sonnet 5.5 | $0.00005 | $0.00534 |
| Haiku 4.5 | $0.00003 | $0.00267 |
Grade D, and why
atlas-cloud-media scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
author: binyangzhu000-sudo tags: [atlas-cloud, image-generation, video-generation, media-api] Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
trap 'rm -rf -- "$atlas_tmp_dir"' EXIT Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl --fail --silent --show-error \ Copies of this mod
1 near-identical copy found in the catalogue:
- atlas-cloud-media — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 292 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Atlas Cloud Media
Overview
Use Atlas Cloud's asynchronous media API to generate images or videos. This source-only skill describes model discovery, schema validation, task submission, bounded polling, and safe output retrieval; it does not bundle an SDK, executable, or hosted runtime.
When to Use This Skill
- Use when the user explicitly asks to generate an image or video with Atlas Cloud.
- Use when an existing workflow needs an Atlas Cloud image or video generation request and can make HTTPS calls.
- Use when model-specific parameters must be discovered before submission.
- Do not use this skill for OpenAI-compatible text chat; that API has a different base URL and contract.
Preconditions
- Confirm the user is authorized to send the prompt and any reference media to a third-party service.
- Explain that generation is paid and obtain approval before submitting a billable request.
- Require
ATLASCLOUD_API_KEYto be present in the environment. Never ask the user to paste it into chat, source files, command history, or logs. - Confirm the output directory and whether the user wants image generation, video generation, or both.
API Contract
| Operation | Method and endpoint |
|---|---|
| List models | GET https://api.atlascloud.ai/api/v1/models |
| Generate image | POST https://api.atlascloud.ai/api/v1/model/generateImage |
| Generate video | POST https://api.atlascloud.ai/api/v1/model/generateVideo |
| Poll task | GET https://api.atlascloud.ai/api/v1/model/prediction/{id} |
Generation and polling requests use these headers:
Authorization: Bearer $ATLASCLOUD_API_KEY
Content-Type: application/json
The model catalog is public. Each catalog entry includes a schema URL; fetch
that schema and validate parameters against it before sending a paid request.
Do not guess parameters from another model, because names such as size,
ratio, aspect_ratio, image, and image_url are model-specific.
Workflow
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 292 lines · 25 tokens per session scan D ad17fcbffcc3
atlas-cloud-media is a skill published in the GitHub repository sickn33/agentic-awesome-skills (49,158 stars, last pushed yesterday), licensed MIT. It adds 25 tokens to every session and 2,671 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
atlas-cloud-media
Generate Atlas Cloud images and videos through its asynchronous media API with schema-first model selection and credential-safe polling.
build-nitro-modules
Builds React Native Nitro Modules from scratch in a monorepo. Scaffolds with Nitrogen, authors HybridObject TypeScript specs, generates native boilerplate, implements in C++/Swift/Kotlin, wires an example app, and prepares for npm publishing. Use when creating a new Nitro Module, implementing native functionality via…
ai-studio-image
Geracao de imagens humanizadas via Google AI Studio (Gemini). Fotos realistas estilo influencer ou educacional com iluminacao natural e imperfeicoes sutis.
redis-master
Leverage Redis for caching, sessions, pub/sub, queues, rate limiting, and real-time features. Design Redis data structures for optimal performance.
mysql-expert
Design, optimize, and maintain MySQL databases. Covers schema design, indexing strategies, query optimization, replication, and performance tuning.
openapi-designer
Design complete OpenAPI 3.1 specifications for RESTful APIs. Covers schemas, security, examples, webhooks, and documentation generation.