Agent skills

Atmos is the security reviewer for every change a coding agent makes. A skill teaches your agent to write rules for your project into .atmos/rules/, and a scan hook runs after every agent turn and hands the findings back to the agent that fixes what it just wrote.

What a rule adds to a prompt#

You can tell an agent to never register a route without auth, and it will usually comply, but the instruction can fall out of a long conversation. A rule in .atmos/rules/ turns the instruction into a check that Atmos runs on every scan, for agents, people and CI alike. Your agent writes the rule once, and Atmos checks every change against it from then on.

Ask your agent to write rules#

Agents are well suited to rule writing. They can find your middleware, your query builders and your naming conventions, and they can run the validate and tune loop themselves. A good request names the convention, the enforcement point and the acceptance bar:

Our auth middleware is requireAuth from src/middleware/auth.ts.
Read the Atmos custom-rules docs at docs.atmoslab.dev/custom-rules,
then write a rule into .atmos/rules/ that flags any Express route
registered without requireAuth or an explicit allowAnonymous marker.
Validate it with `atmos scan . --format json` and tune it until it
reports zero false positives on the current tree. Commit the rule.

Three guardrails make this reliable:

• Make it validate. The agent must run atmos scan . --format json and iterate until the rule fires only where it should.
• Exempt on purpose, in the rule. Public routes and approved escapes belong in the rule as allowlists, or as markers that are visible in the code. Testing and tuning shows both shapes.
• Review the rule like code. It lands in .atmos/rules/, goes through the same pull request as everything else and travels with the repository.

The protect-this-web-repo skill#

Atmos ships this workflow as a ready-made agent skill named protect-this-web-repo, in the standard skill format (a SKILL.md with rule templates and scripts alongside) that Claude Code and Cursor understand. Installed into your repository's .claude/skills/ directory, the skill activates when you ask the agent to protect the repository. The skill then:

1. discovers how your repository does authentication and authorization,
2. confirms with you which routes are meant to be public,
3. writes rules specific to your repository into .atmos/rules/, adapting validated templates for Express, Koa, Fastify, Spring and ASP.NET,
4. validates them with atmos scan . --no-incremental --format json until they report zero false positives on your tree,
5. installs the scan hook below, so the protection stays active.

The scan hook#

The hook closes the loop. After every agent turn, atmos scan . --incremental --format json runs over the tree. If there are findings, the hook blocks the agent's stop and hands the findings back, and the agent fixes what it just introduced before moving on. Warm scans measure well under a second, so the hook does not slow the agent down.

The installer copies the script to .atmos/hooks/atmos-scan.sh and wires it into .claude/settings.json:

{
  "hooks": {
    "Stop": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "\"$CLAUDE_PROJECT_DIR\"/.atmos/hooks/atmos-scan.sh"
          }
        ]
      }
    ]
  }
}

A machine without atmos installed never blocks the agent. For Cursor and CI, set the hook to advisory mode, where it reports findings without blocking.