Security audit

Antigravity

Security checks for vulnerabilities and agentic risk

Overview

This plugin transparently connects OpenClaw to a local Google Antigravity CLI and its higher-risk options are disclosed and disabled by default.

Install only if you intend OpenClaw to run the local AGY CLI. Review the configured command path, addDirs, project, logFile, and especially dangerouslySkipPermissions before enabling it in a shared or sensitive workspace.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/cli/agy-process.js:41
Evidence: const child = spawn(options.command, [...options.args], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/harness/model-catalog.js:15
Evidence: const child = spawn(params.command, [...params.args], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/cli/agy-process.ts:86
Evidence: const child = spawn(options.command, [...options.args], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/harness/model-catalog.ts:39
Evidence: const child = spawn(params.command, [...params.args], {