The Agent Skills Directory

[COMMAND_EXECUTION]: The utility scripts, such as scripts/test-hook.sh and scripts/hook-linter.sh, are designed to execute other local scripts and shell commands provided as arguments. While this is the intended purpose of a testing and linting toolset, it allows for the execution of arbitrary local files.
[DYNAMIC_EXECUTION]: The skill documents and provides examples for 'command hooks' that execute bash scripts in response to agent events (e.g., PreToolUse, SessionStart). This mechanism allows for dynamic behavior based on script files located in the ${ANTIGRAVITY_PLUGIN_ROOT}/scripts directory.
[INDIRECT_PROMPT_INJECTION]: The 'Prompt-Based Hooks' feature involves passing untrusted data, such as tool inputs ($TOOL_INPUT) or user prompts ($USER_PROMPT), directly into an LLM prompt for evaluation. This creates a surface for indirect prompt injection if the evaluation prompt is not designed with robust delimiters or instructions to ignore embedded commands.
Ingestion points: SKILL.md and references/patterns.md describe hooks receiving external data through variables like $TOOL_INPUT, $TOOL_RESULT, and $USER_PROMPT.
Boundary markers: The provided examples generally rely on natural language descriptions within the prompt without strict structural delimiters (like XML tags) to separate the untrusted data from the instructions.
Capability inventory: The system allows hooks to block or allow operations, modify inputs, and execute shell scripts, providing a significant capability chain if a hook is successfully compromised via injection.
Sanitization: The 'Command Hook' examples (e.g., examples/validate-write.sh) demonstrate manual sanitization using bash regex and path checks, but prompt-based hooks rely on the underlying model's reasoning.

hook-development