Antigravity CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:17 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Google coding-agent wrapper, but it promotes unverified remote installers and permission-bypass modes that can let an external agent change local files without normal review.

Install only if you are comfortable running a third-party autonomous coding CLI. Avoid the piped installer; download and verify installers first where possible. Use plan or review modes by default, keep `--add-dir` narrowly scoped, avoid permission-bypass flags except in disposable sandboxes, and do not include secrets or confidential repositories unless Google account, billing, and data-handling implications are approved.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:45

Finding

Remote installers are downloaded and executed without integrity verification

Content

View full analysis

Remediation

View remediation

antigravity-install.sh" | sha256sum --check - less antigravity-install.sh bash antigravity-install.sh ``` 7. For PowerShell, use `Invoke-WebRequest -OutFile`, verify an Authenticode signature or cryptographic hash, inspect the file, and invoke it only after validation. 8. Do not delete downloaded installers until validation, installation review, and incident-troubleshooting requirements have been satisfied. 9. Run installation as an unprivileged user and document the exact files and configuration entries that the installer is expected to create. 10. Where possible, use a trusted package manager with signed metadata rather than a custom remote shell installer. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:202

Finding

Documentation promotes bypassing authorization prompts for autonomous coding agents

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The installation instructions pipe a remotely fetched script directly into a shell, which creates a classic remote code execution and supply-chain risk. If the hosting domain, transport, or delivered script is compromised, users execute attacker-controlled code immediately with their local privileges.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

bash

# Linux / macOS
curl -fsSL https://antigravity.google/cli/install.sh | bash

# Windows (PowerShell)
irm https://antigravity.google/cli/install.ps1 | iex

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The command chain using '| bash' removes the opportunity for inspection between download and execution, amplifying the danger of malicious or tampered installer content. In a skill that encourages terminal execution, this pattern is especially risky because users are likely to copy-paste it verbatim.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

bash

# Linux / macOS
curl -fsSL https://antigravity.google/cli/install.sh | bash

# Windows (PowerShell)
irm https://antigravity.google/cli/install.ps1 | iex

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md

agy -p "Review all Python files" --add-dir /path/to/project

# Model selection
agy -p "Complex task" --model gemini-2.5-pro

# JSON output
agy -p "List all functions" --output-format json

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Fetching and executing an external script directly from a remote URL is a classic supply-chain risk and enables immediate arbitrary code execution if the server, transport, or distribution channel is compromised. In this skill, the danger is amplified because the installation is framed as the recommended path for enabling an autonomous code-editing tool.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Linux / macOS (Recommended)

bash

curl -fsSL https://antigravity.google/cli/install.sh | bash

This installs agy to ~/.local/bin/agy and adds it to PATH.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The specific shell chaining pattern '| bash' removes the opportunity to inspect downloaded content before execution and is dangerous even when the source appears legitimate. If exploited through compromised hosting or content substitution, it results in immediate command execution under the current user context.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Linux / macOS (Recommended)

bash

curl -fsSL https://antigravity.google/cli/install.sh | bash

This installs agy to ~/.local/bin/agy and adds it to PATH.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

bash

# Use specific model
agy -p "Refactor this code" --model gemini-2.5-pro

# List available models
agy models

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill includes an example invoking another coding agent with a permission-bypass flag, normalizing the use of unrestricted autonomous tooling. This expands risk beyond the named tool and encourages a pattern of running agents that can alter code or execute actions without guardrails, especially dangerous in shared or sensitive repositories.

Content

Scanner excerpt · SKILL.md (reported line 368)May include surrounding context.

bash

# Claude Code (default, subscription-based)
claude --permission-mode bypassPermissions --print "refactor code"

# Antigravity CLI (free, Google-based)
agy -p "refactor code"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · examples/code-generation.md (reported line 17)May include surrounding context.

md

- GET /api/users - List all users
   - GET /api/users/<id> - Get single user
   - PUT /api/users/<id> - Update user
   - DELETE /api/users/<id> - Delete user
3. Input validation for email format
4. Proper error handling with appropriate HTTP status codes
5. SQLite database for storage

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README promotes autonomous code editing and edit-accepting refactoring but does not explicitly warn that the tool may modify local project files. In a skill intended to be invoked by an agent, this omission can cause users to run commands with unsafe assumptions about read-only behavior, increasing the risk of unintended code changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 81)May include surrounding context.

md

agy -p "Explain what this function does"

# Code generation
agy -p "Create a Python Flask API with CRUD endpoints"

# Code review
agy -p "Review src/ for security vulnerabilities" --effort high

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README shows use of --add-dir and project-wide review commands that transmit local code context to an external Google service, but it does not disclose the privacy or data-transfer implications. Users may unknowingly send proprietary, regulated, or secret material off-host during routine use of the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description says to use the skill for 'any programming task' and trigger on phrases like 'code generation', 'refactor code', and 'debug code'. These are broad, common requests in coding contexts and the description does not clearly constrain when this skill should be chosen over other coding tools beyond a few examples, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill recommends executing a remote installation script directly via shell piping, which allows arbitrary code from the network to run immediately on the host without prior inspection. In a skill meant for autonomous coding assistance, this is especially dangerous because users or agents may follow it in privileged environments, turning supply-chain compromise or domain hijack into code execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

result=$(agy -p "Generate a Python function to calculate fibonacci")

Redirect to file

agy -p "Write unit tests for main.py" > tests.md

text

### 2. Interactive Mode (TTY Required)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation presents auto-approval and auto-apply modes in a way that can normalize unattended modification or execution without sufficiently emphasizing the risk of unintended edits or destructive actions. Because this skill is for autonomous code manipulation, reduced permission friction increases the chance of broad, accidental, or unsafe repository changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The skill explicitly documents a mode that skips permission checks for an autonomous coding agent. Even though it includes 'USE WITH CAUTION,' the feature materially increases risk by allowing the agent to take actions without interactive approval, which can lead to unintended file changes, command execution, or propagation of insecure modifications.

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

8. Permission Modes

bash

# Auto-approve all tool actions (USE WITH CAUTION)
agy -p "Refactor entire project" --dangerously-skip-permissions

# Plan mode — only suggest, don't execute

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

Recommending auto-approve as a troubleshooting path for timeouts or hangs encourages bypassing safeguards to get tasks unstuck. In the context of an autonomous coding agent, this can convert a transient usability issue into uncontrolled actions on the filesystem or project contents.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

Increase timeout

agy -p "complex task" --print-timeout 10m

Or auto-approve permissions (use with caution)

agy -p "task" --dangerously-skip-permissions

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/refactoring.md (reported line 55)May include surrounding context.

npm run lint

Manual testing

curl -X POST http://localhost:3000/login -d '{"email":"[e-mail]","password":"test"}'

text

## Tips

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example explicitly recommends --mode accept-edits, which can cause the coding agent to automatically write or overwrite files. In a skill intended for autonomous programming assistance, omitting a warning about reviewing changes first increases the chance of unintended or unsafe modifications being applied to a user's codebase.

Content

No source excerpt is available for this finding.