invoking-antigravity

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill tells operators to save/restore the OAuth token file and to capture/paste an authorization code into a file, which instructs copying and handling of secret credential material and could require the LLM or an agent to read or reproduce those secrets verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The URL https://antigravity.google/cli/install.sh is a direct remote shell installer (curl | bash), which is a high-risk pattern for distributing malicious code even if the domain appears related to Google; the other URLs are OAuth or documentation endpoints and are not download sources.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow shells out to python3 scripts/agy_auth_broker.py, which reads untrusted free-text from the agy TUI running under a pty, logs whatever bytes it receives, and extracts an OAuth URL from that pty output buffer (even though the TUI is Google-authored, the workflow ingests free-form output text at runtime).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs installing a remote installer script with curl -fsSL https://antigravity.google/cli/install.sh | bash which fetches and executes remote code as a required setup step, so this URL is a runtime external dependency that executes code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs bypassing security (exporting SSH_* env vars so tokens are written to files rather than the OS keyring) and uses an explicit --dangerously-skip-permissions flag (and even recommends curl|bash install), which are actions that weaken or bypass host security and can compromise the machine state.