The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to download the agy-auto toolkit from an untrusted community repository (github.com/onkarbadve/agy-auto).
[REMOTE_CODE_EXECUTION]: The installation and configuration process involves executing shell scripts (install.sh, hook.sh) and running Python test suites directly from the downloaded content. While the skill suggests manual review, the primary workflow relies on executing external, unverified code.
[COMMAND_EXECUTION]: The skill explicitly instructs the user to set toolPermission: "always-proceed" in the Antigravity CLI settings. This disables the native human-in-the-loop security gate, delegating all permission decisions to the downloaded third-party scripts.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a security gate for processing tool calls generated by an LLM agent, making it a target for indirect prompt injection.
Ingestion points: The hook.sh script intercepts arbitrary command strings and arguments generated by the agent.
Boundary markers: The skill claims to use deterministic policies (Hard Deny/Fast Allow) and an LLM classifier to delimit safe actions.
Capability inventory: The system manages significant capabilities including shell command execution (run_command), file modifications, and network egress.
Sanitization: The skill relies on an LLM-based classifier (Gemini or local model) and a token-based approval system to sanitize and validate untrusted agent inputs.
[PERSISTENCE]: The install.sh script registers the agy-auto hook in hooks.json, ensuring the external code persists and runs automatically whenever the CLI is invoked in the future.

agy-auto