Security audit

Antigravity CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent wrapper for Google Antigravity CLI, but it broadly routes coding work to a networked autonomous agent with automatic edit modes and pipe-to-shell installation guidance.

Install only if you intentionally want Google Antigravity CLI handling coding tasks. Review the remote installer before running it, avoid sensitive or proprietary repositories unless approved for Google AI processing, use narrow --add-dir scopes, prefer plan/review modes before accept-edits, and work from version control or a disposable branch.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README advertises autonomous code editing and project-context awareness but does not warn users that local source files may be modified and that repository contents may be transmitted to Google's external service. In a coding-agent skill, omission of these trust-boundary and data-handling warnings can lead users to expose proprietary code or allow unintended edits without informed consent.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The installation instructions pipe remotely fetched shell and PowerShell scripts directly into interpreters, which is a well-known unsafe pattern because users execute unaudited code from the network immediately. If the remote endpoint, transport, or published installer is compromised, this can result in arbitrary code execution on the user's machine.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger description is extremely broad and matches generic programming requests such as code generation, refactoring, debugging, and review. This can cause the skill to be invoked for a large share of coding tasks, unnecessarily routing user work to an autonomous external CLI with network access, code-editing capability, and credential use, increasing the chance of unsafe delegation or unintended tool execution.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The 'When to Use' guidance repeats ambiguous activation criteria like generate, refactor, debug, and review code without strong boundaries, making accidental or over-broad invocation likely. In this skill, that is more dangerous because the referenced tool supports autonomous editing, internet access, authentication tokens, and risky modes such as auto-approving permissions, so misrouting routine tasks has real security consequences.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The example explicitly recommends `--mode accept-edits` and `--add-dir ./existing-project`, which can cause autonomous modification of an existing codebase without any warning, review step, backup guidance, or scope limitation. In a coding-agent skill, this increases the risk of unintended overwrites, destructive refactors, or insertion of unsafe code into user files.

Static analysis

No suspicious patterns detected.