Antigravity Image Gen 1.0.0

• Analyzed: May 12, 2026, 3:59 AM
• Findings: 1
• Version: 1.0.0
• Hash: b2815877d4bff4a49150e04e9f8ee929ea00b75b326afe877fba29f9677a3412
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to a Local File Write vulnerability in `scripts/generate.js`. The `--output` argument, which can be controlled by user input (or prompt injection against the agent), is directly used in `fs.writeFileSync` without sanitization. This allows an attacker to potentially write arbitrary image data to arbitrary file paths on the system. While the script's stated purpose is image generation and it accesses OAuth tokens for this purpose, the lack of input sanitization for file paths poses a significant security risk. There is no clear evidence of intentional malicious behavior like data exfiltration to unauthorized endpoints or persistence mechanisms.