The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external files and user-supplied prompts which are passed to the agy CLI, creating a surface where malicious instructions embedded in data could influence agent behavior.
Ingestion points: The skill accepts a $TASK_PROMPT and reads files from the workspace using view_file or the --add-dir flag (SKILL.md).
Boundary markers: Instructions advise using "isolated workspaces" and "authorized workspace boundaries" to limit the impact of the execution (SKILL.md).
Capability inventory: The agy CLI is capable of performing file system reads, writes, and command execution (SKILL.md, references/monitoring.md).
Sanitization: No explicit sanitization or filtering of external content is mentioned; the skill relies on the underlying CLI's internal safety mechanisms.
[COMMAND_EXECUTION]: The skill facilitates the execution of the agy CLI tool to carry out coding tasks and verify host status (SKILL.md).
[CREDENTIALS_UNSAFE]: The skill provides instructions for configuring and managing GEMINI_API_KEY and GOOGLE_GEMINI_BASE_URL (references/api-mode.md).
Evidence: It details setting these sensitive values in the environment and modifying configuration files like .gemini/antigravity-cli/settings.json.
Note: The skill includes specific instructions to redact these values in logs and keep them out of repositories.
[PRIVILEGE_ESCALATION]: The skill documents the use of the --dangerously-skip-permissions flag for the agy CLI (SKILL.md).
Evidence: This flag bypasses standard internal permission checks and "approves every tool," granting the agent broad capabilities within the authorized workspace.
[PERSISTENCE]: The skill mentions the ability to persist API keys to shell profiles if requested by the user (references/api-mode.md).
Evidence: "Persist to the intended shell profile only when requested."

antigravity-coding-agent