The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs users to install the google-antigravity Python package from PyPI and references the google-antigravity GitHub organization. These are untrusted third-party resources that are not part of a verified vendor list, posing a supply chain risk.
[INDIRECT_PROMPT_INJECTION]: The skill documentation creates a surface for indirect prompt injection by instructing agents to automatically ingest and respect data from the local environment.
Ingestion points: references/ide.md specifies that the agent should automatically discover and load project-specific rules, skills, and plugins from the .agents/ folder in the project root.
Boundary markers: The instructions lack any requirement for the agent to use delimiters or ignore potentially malicious instructions embedded within these workspace-provided files.
Capability inventory: The skill encourages the configuration of agents with high-privilege tools, including run_command (terminal access) and edit_file (filesystem access), as detailed in references/sdk.md and references/app.md.
Sanitization: There is no mention of sanitizing or validating the content of the files loaded from the .agents/ directory.
[METADATA_POISONING]: The skill uses deceptive branding to appear as an official Google-authored resource. It references URLs on the restricted .google TLD (e.g., antigravity.google) and utilizes internal-style engineering tags (e.g., LINT.IfChange). This deceptive context may cause users or agents to lower their security posture when interacting with the associated untrusted software packages.

antigravity-guide