antigravity-cli
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation references official installation scripts for the Antigravity CLI from the antigravity.google domain.
- Evidence: References installation commands targeting https://antigravity.google/cli/install.sh (Linux/macOS), https://antigravity.google/cli/install.ps1 (PowerShell), and https://antigravity.google/cli/install.cmd (Windows).
- [REMOTE_CODE_EXECUTION]: The skill documents how to download and execute installation scripts for the Antigravity CLI.
- Evidence: Provides shell commands that pipe remote content directly into an interpreter (e.g., curl ... | bash, irm ... | iex) from the antigravity.google domain.
- [INDIRECT_PROMPT_INJECTION]: The skill operates a coding agent (Antigravity CLI) that ingests untrusted repository content and possesses powerful execution capabilities, creating a surface for indirect prompt injection.
- Ingestion points: The agy tool reads project files and repository content (e.g., TASK.md, source code) in the provided workdir (documented in SKILL.md).
- Boundary markers: The skill includes procedural warnings for the operator (e.g., "Review agy's commit yourself", "establish the tsc -b error baseline"), but no programmatic delimiters are defined for the data processed by the tool.
- Capability inventory: The agy tool can execute terminal commands, modify files, and access network resources through its own sub-agents and plugins.
- Sanitization: There is no evidence of input sanitization or filtering of the external content processed by the tool within the skill's instructions.
Audit Metadata