gemini-antigravity-cli
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to download a pre-built binary from a GitHub repository belonging to an untrusted user ('testerlingcodo'). This poses a supply chain risk as the binary's integrity cannot be verified against the source code.
- Evidence: 'wget https://github.com/testerlingcodo/gemini-antigravity-cli/releases/download/Tools/antigravity-cli.zip'
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from multiple sources, creating a large surface for indirect prompt injection attacks.
- Ingestion points: The skill reads local project files via the '/context' command, processes git diffs for code reviews, and integrates with Model Context Protocol (MCP) servers.
- Boundary markers: There are no instructions for the agent to use delimiters or ignore instructions embedded within the files it reads.
- Capability inventory: The skill has the capability to read/write files and access environment variables containing sensitive API keys.
- Sanitization: No sanitization or validation mechanisms are mentioned for the external content being processed.
- [COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary commands through the Model Context Protocol (MCP) server configuration, which could be exploited if the agent is influenced by malicious input.
- Evidence: Example configuration shows usage of 'npx' to run MCP servers with arguments and environment variables.
- [CREDENTIALS_UNSAFE]: The documentation guides users to store Google API keys and GitHub tokens in environment variables and shell profile files (e.g., ~/.bashrc). While this is a common developer practice, these credentials become accessible to the AI agent and could be exfiltrated if the agent is compromised via indirect injection.
Audit Metadata