google-antigravity-ops
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill exposes the structure of the local filesystem by hardcoding absolute paths for a specific user profile directory (
/Users/kdawg/). This includes locations for potentially sensitive configuration and instruction files such as/Users/kdawg/AGENTS.md,/Users/kdawg/.agents/mcp_config.json,/Users/kdawg/.agents/hooks.json, and/Users/kdawg/.gemini/config/import_manifest.json. - [COMMAND_EXECUTION]: The skill instructs the agent to use the
agyCLI tool to manage its environment. It includes instructions to list, validate, and install local plugins (agy plugin install <path>), which allows the agent to extend its capabilities by loading and executing local code. - [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection via the command
agy --print "<prompt>". 1. Ingestion points: User-provided input interpolated into the prompt string. 2. Boundary markers: None present. 3. Capability inventory: Ability to install and validate plugins (agy plugin install), and access to workspace configuration and skills. 4. Sanitization: No sanitization or escaping of the interpolated content is specified.
Audit Metadata