Antigravity Image Generator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:04 AM UTC
• Version: 2.0.0

Overview

This image-generation skill is not clearly malicious, but it needs review because it uses local Google OAuth credentials with an internal API and spoofed client headers.

Install only if you are comfortable letting this skill read your local Google Antigravity OAuth profile, send your image prompts to the internal Google sandbox endpoint, and potentially use account or project quota under spoofed client metadata. Prefer a version that uses a documented API, an explicit project, and a dedicated least-privilege credential.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.js:107

Finding

Unsupported Internal API Access Using Spoofed Client Metadata

Content

View full analysis

{ ``` The associated endpoint and fallback project configuration are defined at lines 17-20: ```js const ENDPOINT = "https://daily-cloudcode-pa.sandbox.googleapis.com/v1internal:streamGenerateContent?alt=sse"; const PROFILE_PATH = process.env.OPENCLAW_AUTH_PATH || path.join(process.env.HOME || process.env.USERPROFILE, '.openclaw/agents/main/agent/auth-profiles.json'); // Project ID found in auth profile or fallback const FALLBACK_PROJECT_ID = "junoai-465910"; ``` ### Technical Analysis The script calls a Google endpoint whose route is explicitly identified as `v1internal` and deliberately supplies client metadata associated with Antigravity, Google Cloud SDK, and a VS Code Cloud Shell editor. The source comment states that the fabricated version is intended to bypass deprecation checks. This creates an unsupported authentication and API-access pattern. The request is not transparently identifying the actual skill implementation, and its continued operation depends on internal behavior that may change without compatibility or security guarantees. The hard-coded fallback project identifier can also cause requests to be associated with a project that was not ...[truncated 1987 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This code accesses an OAuth bearer token from a local profile and uses it for authenticated API calls. Accessing host-stored tokens is credential access behavior; if the skill is modified, compromised, or pointed at a different endpoint, that token could be abused for unauthorized actions or exfiltration.

Content

Scanner excerpt · scripts/generate.js (reported line 69)May include surrounding context.

js

const auth = profiles.profiles[profileKey];

    if (!auth || !auth.access) {
        console.error("Error: No google-antigravity profile or access token found.");
        process.exit(1);
    }

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises code execution requirements and explicitly states it reads local OAuth tokens, but it does not declare any tool or permission scope to constrain access. This creates a capability/visibility mismatch where an agent may invoke a skill that can access sensitive local authentication material without clear sandboxing or least-privilege boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation conditions are broad enough to match many ordinary requests for visual content, which can cause the skill to trigger unexpectedly. In this skill's context, unintended invocation is more concerning because the skill uses local OAuth credentials and an internal API, increasing the chance of unnecessary exposure or use of privileged resources.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script reads a local OpenClaw auth-profile file and extracts an OAuth access token to authenticate outbound requests. Even though the skill's stated purpose is image generation, directly harvesting host credentials from a generic auth store gives the skill access to sensitive bearer tokens and expands its privileges beyond a narrowly scoped, user-supplied API key flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script sends both user prompt content and a bearer token to a remote service without any explicit consent prompt or warning to the user. In the context of a skill that silently reads local auth data, this creates a meaningful risk of unanticipated credential use and disclosure of potentially sensitive prompt content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The top-level documentation states the script uses the google-antigravity OAuth token, suggesting a direct token source. In practice, the code loads credentials from a local OpenClaw auth-profiles JSON file and searches for a matching profile, which is a different mechanism than the docstring implies.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code intentionally spoofs client-identifying headers, including a User-Agent and API client metadata, and the inline comment explicitly states the goal is to bypass deprecation checks. Deliberately impersonating another client weakens trust boundaries, may evade platform controls, and is especially concerning when combined with stolen/local credentials and an internal-looking endpoint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.