sync-conversations-antigravity

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/sync_antigravity.py uses the subprocess module to execute ssh commands. These commands are used to check connectivity, download history files, and establish pipes for data transfer.
  • [REMOTE_CODE_EXECUTION]: The skill executes dynamically generated Python scripts on the remote machine via SSH (python -c "..."). This logic is used to package (tarfile) and extract files on the remote side without requiring pre-installed external utilities like tar or find on the target system.
  • [DATA_EXFILTRATION]: The skill transfers sensitive information including history.jsonl (conversation metadata), SQLite session databases from the conversations/ directory, and the installation_id (a session identity key). This data transfer occurs over the network via an SSH tunnel between the local and remote hosts as part of the synchronization process.
  • [CREDENTIALS_UNSAFE]: The synchronization process specifically includes the installation_id, which is a sensitive identifier used by the backend to validate workspaces and maintain session continuity. This key is moved between devices to ensure the environment remains consistent across development machines.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 05:19 AM
Security Audit — agent-trust-hub — sync-conversations-antigravity