The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The SDK provides a significant attack surface for indirect prompt injection, as it is designed to ingest and process untrusted external data which can then influence powerful tool executions. \n- Ingestion points: read_url_content (fetches web content), view_file (reads local files), search_web (processes search engine results), and Document.from_file (parses PDFs and images). \n- Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions when interpolating external content into prompts, though it emphasizes structured output and schema validation. \n- Capability inventory: The SDK includes tools for shell command execution (run_command), filesystem modification (create_file, edit_file), subprocess spawning (McpStdioServer), and Python code execution (run_workflow). \n- Sanitization: The SDK implements strong defensive measures, including a declarative safety policy system, OS-level command sandboxing (enable_sandbox), and a restricted execution environment for workflows that forbids imports and certain Python builtins. \n- [COMMAND_EXECUTION]: The SDK provides built-in capabilities to execute shell commands and manage external processes. \n- Evidence: The run_command tool allows the agent to execute arbitrary shell strings. This is denied by default in the standard configuration, requiring explicit user opt-in or confirmation. \n- Evidence: The Model Context Protocol (MCP) integration allows the agent to launch and communicate with external server processes via McpStdioServer. \n- [DYNAMIC_EXECUTION]: The SDK supports the definition and execution of multi-agent workflows using Python scripts. \n- Evidence: The run_workflow feature executes Python code snippets or script files. This execution is confined to a 'Workflow Sandbox' which restricts available builtins, prevents imports, and enforces structural rules to mitigate risks. \n- [EXTERNAL_DOWNLOADS]: The documentation describes how to download model checkpoints from well-known external repositories. \n- Evidence: The litert-lm import command is used to download the Gemma 4 model from Hugging Face's public repositories (litert-community/gemma-4-26B-A4B-it-litert-lm).

google-antigravity-sdk