Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/index.js:61
- Evidence
return execFileSync(resolvePython(), [scriptPath, ...args], {
Security audit
Antigravity CLI Harness
Security checks across malware telemetry and agentic risk
Overview
The plugin mostly does what it claims, but it under-discloses that it runs Antigravity CLI with permission-skipping enabled, which deserves user review before installation.
Review this before installing if you use Antigravity CLI on sensitive workspaces or with a valuable Google account. The main concern is not hidden exfiltration, but that the backend launches `agy` in a no-confirmation mode; only use it where you are comfortable letting that CLI act without normal permission prompts. Also expect the included session commands to be broken unless the missing helper scripts are supplied separately.
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.dangerous_exec