antigravity-design-prompt
Fail
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONPROMPT_INJECTIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The reference file 'references/HowIbuildBeautiful10000WebsiteswithAI.txt' instructs the agent to add a 'Vercel MCP' tool to its configuration using 'npx -y @robinson_ai_systems/vercel-mcp'. This command downloads and executes an external package from the NPM registry at runtime. The source organization is not a verified official vendor for Vercel, representing a significant supply chain risk.
- [PROMPT_INJECTION]: The skill contains direct instructions intended to manipulate the agent's configuration: 'I would like you to add the below Vercel MCP to my MCP config within Antigravity.' This attempts to bypass the agent's fixed toolset by injecting new capabilities through data files.
- [CREDENTIALS_UNSAFE]: The instructions direct the user to obtain a Vercel API key and hardcode it into the configuration snippet under the 'VERCEL_TOKEN' environment variable. This promotes insecure secret management practices.
- [COMMAND_EXECUTION]: The proposed 'npx' command within the configuration allows for the execution of arbitrary scripts and binaries from an external source on the local system.
Recommendations
- AI detected serious security threats
Audit Metadata