The Agent Skills Directory

[COMMAND_EXECUTION]: The tool relies on the subprocess module to invoke the ssh binary for connection testing and executing commands on remote development machines.
[REMOTE_CODE_EXECUTION]: To manage data synchronization without external dependencies like 'tar', the script generates and executes Python code snippets on the remote host via ssh <host> python3 -c '...'. This allows arbitrary code execution on the target machine.
[EXTERNAL_DOWNLOADS]: The skill performs bidirectional transfer of application data, including SQLite databases and history logs, over the network via SSH tunnels.
[CREDENTIALS_UNSAFE]: The synchronization process includes the installation_id file. According to the skill documentation, this ID is used by the backend to associate workspaces and maintain session connections. Transferring this identifier between machines exposes session authentication data.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It instructs the agent to read and 'resolve' conversation titles from the history.jsonl file, which can be populated with untrusted data from a remote machine. There are no boundary markers or sanitization processes to prevent the agent from following instructions embedded in conversation titles or history entries.
Ingestion points: history.jsonl is loaded and its content is inspected by the agent to find matching conversations.
Boundary markers: None. The agent is simply told to inspect the history to resolve titles.
Capability inventory: The skill can execute remote commands via SSH and write files to the local system.
Sanitization: None observed for the content displayed to or processed by the AI agent.

sync-conversations-antigravity