open-file
Warn
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute Bash commands by interpolating absolute file paths into string templates. Specifically, it uses patterns like
grip -b "<absolute-path>" 6419and"$AGY_IDE" "<absolute-path>". - Evidence: Found in
SKILL.mdunder the 'Markdown: grip' and 'その他: Antigravity IDE' sections. - Risk: While the paths are enclosed in double quotes, Bash still processes command substitutions (e.g.,
$()or backticks) inside double quotes. If a file in the environment has a malicious name or the input is manipulated, this can lead to unauthorized command execution when the agent attempts to open the file. - [SAFE]: The skill references 'Antigravity IDE', which appears to be a tool associated with the vendor 'tanabee'. It uses a local path on macOS for its execution.
Audit Metadata