The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of untrusted code by instructing the agent to run the npx skills add command using arbitrary repository URLs provided by the user. The use of the -y flag in the proposed commands suppresses user confirmation, allowing potentially malicious scripts within the downloaded repository to execute without oversight.
[EXTERNAL_DOWNLOADS]: The primary function of the skill is to fetch and integrate external code from remote sources, such as GitHub repositories, which are not verified by the skill's own logic.
[COMMAND_EXECUTION]: The skill employs complex shell scripts on Linux/macOS and PowerShell on Windows to manipulate the file system. This includes directory creation, recursive deletion (rm -rf), and moving files from temporary locations to global system paths.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection (Category 8). It ingests untrusted data in the form of repository URLs and branch names. The agent is then instructed to process this data using a high-capability toolset (run_command) without boundary markers or sanitization, creating a surface where malicious instructions in the remote repository can take control of the session.
[PERSISTENCE]: By relocating downloaded code to a global shared directory (~/.gemini/skills/), the skill ensures that third-party content is available to all Google Antigravity tools. This creates a persistence mechanism where a single malicious download can affect multiple tools and future agent sessions.

deploy-skills-in-antigravity