guava-router
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads CLI tools and configuration plugins from well-known technology organizations.
- Fetches the Antigravity CLI installation script from Google's official infrastructure (
https://antigravity.google/cli/install.sh). - Installs the
@anthropic-ai/claude-codeand@openai/codexpackages from the public NPM registry. - Downloads the Codex plugin for Claude Code from the official OpenAI repository on GitHub.
- [REMOTE_CODE_EXECUTION]: Executes installation scripts from trusted sources at runtime.
- Pipes the Antigravity CLI installer from a Google-owned domain directly into the system shell (
bashor PowerShell'siex) to perform a global installation. - [COMMAND_EXECUTION]: Performs system-level operations to configure the model routing environment.
- Modifies local configuration and instruction files for various agents, including
~/.claude/settings.json,~/.claude/CLAUDE.md, and~/.gemini/config/mcp_config.json. - Executes CLI commands for authentication, version management, and task routing between tools like Claude Code and Codex.
- Implements a robust backup and restore system that preserves original configuration files before any modifications are made.
Audit Metadata