Maintainer of this skill?
by AtomicBot-ai
Atomic Agent is a local-first AI agent. Runs open-weight models on your own machine via llama.cpp.
# Add to your Claude Code skills
git clone https://github.com/AtomicBot-ai/atomic-agentLast scanned: 6/17/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@vitest/mocker: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
"severity": "high"
},
{
"type": "npm-audit",
"message": "exceljs: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-xml-builder: fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",
"severity": "high"
},
{
"type": "npm-audit",
"message": "node-notifier: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "shell-quote: shell-quote quote() does not escape newlines in object .op values",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tsx: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite-node: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vitest: Vulnerability found",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "high"
},
{
"file": "README.md",
"line": 224,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
},
{
"file": "README.md",
"line": 79,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://api.atomicbot.ai/agent-install | sh\"",
"severity": "low"
},
{
"file": "starter-skills/notion/SKILL.md",
"line": 64,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-06-17T09:04:49.588Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how atomic-agent compares with popular alternatives.
atomic-agent is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by AtomicBot-ai. Atomic Agent is a local-first AI agent. Runs open-weight models on your own machine via llama.cpp. It has 3,478 GitHub stars.
atomic-agent failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/AtomicBot-ai/atomic-agent" and add it to your Claude Code skills directory (see the Installation section above).
atomic-agent is primarily written in TypeScript. It is open-source under AtomicBot-ai on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh atomic-agent against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Drives your browser, edits files, runs approved commands, and remembers context across sessions. Open source, running on our TurboQuant llama.cpp so long sessions with small local models fit in less memory.
Quick Install · Uninstall · Benchmarks · Why Local-First · Ways to Use It · Docs
A local-first AI agent that runs the control loop and all state on your machine. It works across your machine: browse the web, read and edit files, run approved shell commands, inspect documents, remember context across sessions, schedule follow-ups, and call external tools over MCP. Run it on a local model, a cloud model, or both at once in Fusion mode, where one model plans and a pool of workers executes. Embed it in your own apps over HTTP or a Tauri sidecar. llama.cpp first, so small quantized models stay useful for long, multi-step work on consumer hardware.
macOS / Linux:
curl -fsSL https://atomicagent.io/install | sh
Windows (PowerShell):
irm https://atomicagent.io/install.ps1 | iex
The installer downloads the release archive, verifies the checksum, and installs the CLI plus support assets (grammars/, native prebuilds, and bundled ripgrep). Atomic Agent updates itself in place; after an update the TUI prompts you to restart. Outside the TUI, run atomic-agent update (or atag update) to check for a newer release and re-run the installer in place; atomic-agent update --check probes without installing, and --version <tag> pins a specific release. Only the installed binary can self-update; a dev checkout updates via git, and a Linux package (below) updates with the package manager.
On Debian, Ubuntu, Fedora, RHEL-compatible systems and Arch, Atomic Agent also comes as a package, and the package manager then updates it with the rest of the system. A package carries the same release bundle as the installer, under /usr/lib/atomic-agent, with atomic-agent and atag in /usr/bin. The repository and the rpm packages are signed with the Atomic Chat packages key in packaging/atomic-chat.asc, fingerprint 1047 F119 58C6 442D D472 E497 E4C3 D361 FB7F F123.
Debian, Ubuntu (x86-64, arm64):
curl -fsSL https://atomic-agent-packages.fsn1.your-objectstorage.com/atomic-chat.gpg | sudo tee /usr/share/keyrings/atomic-chat.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/atomic-chat.gpg] https://atomic-agent-packages.fsn1.your-objectstorage.com/deb stable main" \
| sudo tee /etc/apt/sources.list.d/atomic-agent.list
sudo apt update && sudo apt install atomic-agent
Fedora, RHEL, Rocky, Alma (x86-64, aarch64):
sudo curl -fsSL -o /etc/yum.repos.d/atomic-agent.repo https://atomic-agent-packages.fsn1.your-objectstorage.com/rpm/atomic-agent.repo
sudo dnf install atomic-agent
Arch Linux: yay -S atomic-agent-bin, or any other AUR helper.
Updates come with sudo apt upgrade, sudo dnf upgrade or yay -Syu; on a packaged install atomic-agent update refuses and names the command to use, and the TUI does not offer its in-app update. A copy left by install.sh in ~/.local/bin runs ahead of the package on the usual PATH and keeps its own updates; atomic-agent update names both copies when that happens, and removing the copy hands the command to the package. sudo apt remove atomic-agent, sudo dnf remove atomic-agent or sudo pacman -R atomic-agent-bin removes the program and leaves your data; atomic-agent uninstall then lists only the data. The repository keeps the last ten releases; older ones are on the releases page as .deb and .rpm files. A package states the glibc its binary needs (2.34 today: Debian 12, Ubuntu 22.04, RHEL 9 and newer), and the package manager refuses where the system's is older.
The desktop app is in the same repository as atomic-agent-desktop (on Arch atomic-agent-desktop-bin). It has releases of its own (desktop-vX.Y.Z), carries its own copy of the agent under /opt/Atomic Agent and leaves a packaged or installed atomic-agent alone, so the two can be installed side by side. Once installed it is in the applications menu, and atomic-agent-desktop starts it from a terminal.
Debian, Ubuntu (x86-64, arm64):
curl -fsSL https://atomic-agent-packages.fsn1.your-objectstorage.com/atomic-chat.gpg | sudo tee /usr/share/keyrings/atomic-chat.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/atomic-chat.gpg] https://atomic-agent-packages.fsn1.your-objectstorage.com/deb stable main" \
| sudo tee /etc/apt/sources.list.d/atomic-agent.list
sudo apt update && sudo apt install atomic-agent-desktop
Fedora, RHEL, Rocky, Alma (x86-64, aarch64):
sudo curl -fsSL -o /etc/yum.repos.d/atomic-agent.repo https://atomic-agent-packages.fsn1.your-objectstorage.com/rpm/atomic-agent.repo
sudo dnf install atomic-agent-desktop
Arch Linux: yay -S atomic-agent-desktop-bin, or any other AUR helper.
Installed as a package, the app is updated with the rest of the system (sudo apt upgrade, sudo dnf upgrade or yay -Syu) and its Settings say so instead of offering an in-app update; the AppImage from the releases page updates itself. sudo apt remove atomic-agent-desktop, sudo dnf remove atomic-agent-desktop or sudo pacman -R atomic-agent-desktop-bin removes the app and leaves your data.
[!NOTE] Developer preview. APIs, commands, config, and behavior are still moving, so pin a release if you need a stable integration point. Current builds: macOS (Apple Silicon), Linux x64 / arm64, and Windows x64. Intel Macs are not supported yet; Windows on ARM runs the x64 build under emulation.
atomic-agent
Both installers also drop a short alias next to the binary, so this is the same thing:
atag
[!TIP] Need a second agent? Press Ctrl+N (or run
/window) inside the TUI: it opens a new terminal window with a fresh atomic-agent in the same directory.
[!TIP] Want to go through first-time setup again? Run
/onboarding(or/setup) in the TUI, or start it withatomic-agent tui --onboarding. Your providers, keys, sessions and memory are kept.
[!TIP] Coming from another agent? The first run offers to bring your data over: tick the sources it found and the import runs, without overwriting anything already here and without touching the source. What moves depends on the source:
- Claude Code: skills, memory, MCP servers, sessions, and (opt-in) provider keys
- Codex: skills, memory, sessions, and (opt-in) provider keys
- Oh-My-Pi: skills, MCP servers, and sessions
- Pi: skills and sessions
- Hermes: sessions, cron jobs, and (opt-in) provider keys
- OpenClaw: sessions and cron jobs
Later, run
/importin the TUI oratomic-agent import <hermes|openclaw|claude-code|codex|pi|oh-my-pi>from the shell.
One command removes everything: the state directory (config, memory, sessions, tasks, traces, downloaded models), the binary and its atag alias, the asset directories beside them, and the PATH line the installer added to your shell rc file:
atomic-agent uninstall
It prints exactly what it will delete, with sizes, and then asks you to type the word uninstall. Nothing is uploaded and nothing is kept; this cannot be undone. Preview it with atomic-agent uninstall --dry-run, keep your data with --keep-data, keep the binary with --keep-binary, leave your shell rc file alone with --keep-path, or skip the prompt in a script with --yes. The same flow is the last entry in the TUI's own menu (Esc → Danger zone, or /uninstall). The desktop app (0.0.3 and later) shares the same ~/.atomic-agent folder. When uninstall finds it, an interactive run asks a separate question before deleting that folder (answer no to remove only the terminal program), and a --yes run keeps the folder and says why; add --include-desktop-data to delete it in a script.
If something isn't working: