agy-auto
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill instructs users to modify
~/.gemini/antigravity-cli/settings.jsonto settoolPermissiontoalways-proceed. This configuration change bypasses the agent platform's default interactive permission prompts for tool invocations, delegating all safety decisions to the installed external hook. - [COMMAND_EXECUTION]: Requires the installation and execution of a shell hook (
hook.sh) that runs logic to evaluate, permit, or deny tool calls at runtime. - [EXTERNAL_DOWNLOADS]: Fetches policy components and configuration scripts from the author's community repository on GitHub.
- [PERSISTENCE]: The installation process registers a permanent PreToolUse hook within the CLI configuration, ensuring the skill's logic is persistently executed during every future tool invocation session.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a risk where natural language instructions in data could trick the agent into authorizing commands. It mitigates this by enforcing a token-based manual approval system (
> agy-approve <token>) and explicitly ignoring conversational approval phrases to prevent 'ambient authority' leakage.
Audit Metadata