The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill reads the agent's global authentication configuration file located at /home/ubuntu/.clawdbot/agents/main/agent/auth-profiles.json. This file contains sensitive OAuth access and refresh tokens for the agent's identity.
[DATA_EXFILTRATION]: The script extracts OAuth access tokens from the local configuration and transmits them to a remote endpoint (daily-cloudcode-pa.sandbox.googleapis.com). While the destination domain belongs to a trusted organization, the extraction of the agent's primary identity tokens for use in an external sandbox API represents a significant data exfiltration risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input via the --prompt argument and interpolates it directly into the model request payload without sufficient isolation.
Ingestion points: The generate.js script accepts untrusted text via the --prompt command-line argument.
Boundary markers: The prompt is embedded within a JSON structure without explicit delimiters or instructions to the model to ignore embedded commands.
Capability inventory: The skill possesses file system access (read/write) and network communication capabilities.
Sanitization: No validation or escaping is performed on the user-supplied prompt string.
[BYPASS_BEHAVIOR]: The script uses forged User-Agent and X-Goog-Api-Client headers to impersonate the VS Code Cloud Shell Editor and Google Cloud SDK. This is used to access an internal sandbox API endpoint (v1internal:streamGenerateContent) that is not intended for standard public usage.

antigravity-image-gen