antigravity
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/antigravity-run.shexecutes theagy(Antigravity) CLI binary. It allows users to pass extra arguments directly to the binary via the--separator and provides an--allow-allflag that maps to the CLI's internal permission bypass. - [DYNAMIC_EXECUTION]: The runner script generates runtime helper scripts (
monitor.shandcontinue.sh) and executes embedded Python snippets to manage JSON processing, environment variable parsing, and process lifecycle controls. These generated scripts use shell-quoted variables to prevent injection. - [INDIRECT_PROMPT_INJECTION]: The skill acts as an interface for the Gemini-powered Antigravity CLI, creating a surface for indirect injection via processed repository content or external prompts.
- Ingestion points: Prompt text/files and local workspace content provided via command-line arguments in
scripts/antigravity-run.sh. - Boundary markers: The skill implements a 'review' mode that uses an isolated Git clone of the workspace to prevent accidental writes to the source repository.
- Capability inventory: The CLI worker can perform file reads/writes, execute shell commands, and make network calls to Google services (controlled by the
--dangerously-skip-permissionsand--sandboxflags). - Sanitization: The runner fingerprints the source workspace before and after execution to detect and fail on unauthorized modifications.
Audit Metadata