ClawHub
Back to skill

Security audit

Antigravity Image Gen 1.0.0

Security checks for vulnerabilities and agentic risk

Overview

This skill does generate images as advertised, but it directly uses a local OAuth profile and an internal Google endpoint in a way users should review carefully before installing.

Install only if you intentionally want this skill to use your local Google Antigravity OAuth session and send image prompts to the internal daily-cloudcode-pa.sandbox.googleapis.com endpoint. Avoid sensitive prompts, review the selected auth profile and project, and use a safe output path because the script can overwrite writable files.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate.js:31
Finding

Arbitrary File Overwrite Through User-Controlled Output Path

Content
View full analysis

Vulnerability Details

File Location: scripts/generate.js, lines 31–34 and 146
Vulnerability Type: Arbitrary file overwrite
Risk Level: Medium

Vulnerable Code

js
} else if (args[i] === '--output' && args[i+1]) {
    outputFile = args[i+1];
    i++;
}
js
fs.writeFileSync(outputFile, Buffer.from(part.inlineData.data, 'base64'));

Technical Analysis

The --output command-line argument is accepted as an unrestricted filesystem path and passed directly to fs.writeFileSync. The script does not canonicalize the path, restrict output to an approved directory, reject symbolic links, check whether the destination already exists, or use exclusive file creation.

When image generation succeeds, fs.writeFileSync creates the selected file or truncates and replaces an existing file. Consequently, anyone able to control the script arguments can overwrite any file writable by the process account.

This issue does not independently provide elevated operating-system privileges. Exploitation remains constrained by the permissions of the account running the skill.

Attack Path

  1. An attacker or untrusted caller invokes the skill with a crafted --output value pointing to an existing sensitive file or a path traversing outside the intended image directory.
  2. The script accepts the path without validation.
  3. The script sends the image-generation request to the configured API.
  4. After receiving image data, the script decodes the Base64 response.
  5. fs.writeFileSync truncates and replaces the selected target with image bytes.
  6. The targeted file becomes corrupted or unusable.

Impact Assessment

Successful exploitation can destroy or corrupt user documents, application configuration, scripts, and other resources writable by the executing account. Overwriting a writable script or configuration file may produce secondary effects when another application later consumes it, al ...[truncated 255 chars]

Remediation
View remediation

Remediation Suggestions

  • Store generated images only in a dedicated, application-controlled output directory.
  • Resolve the requested path with path.resolve and verify that it remains beneath the canonical approved directory.
  • Reject absolute paths, traversal components, symbolic-link destinations, and non-image extensions.
  • Use exclusive creation, such as fs.writeFileSync(path, data, { flag: "wx" }), to prevent replacement of existing files.
  • If replacement is a required feature, require explicit confirmation and verify that the existing destination is a regular file within the approved directory.
  • Create the output directory with restrictive permissions and run the skill under a least-privileged account.
  • Consider generating the destination filename internally rather than accepting an arbitrary caller-supplied path.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (10)

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The code explicitly accesses an OAuth access token from a local auth store and uses it in an Authorization header for a remote request. In a skill environment, this is credential access behavior that can be repurposed for unauthorized actions or abuse of the user's cloud identity if the script is modified, misused, or invoked unexpectedly.

Content

Scanner excerpt · scripts/generate.js (reported line 69)May include surrounding context.

js
const auth = profiles.profiles[profileKey];

    if (!auth || !auth.access) {
        console.error("Error: No google-antigravity profile or access token found.");
        process.exit(1);
    }

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill declares executable capabilities and relies on environment-resident OAuth state, but it does not declare any explicit tool scope or permissions boundaries. That makes it harder for the agent framework and users to understand that the skill may access sensitive local auth material and invoke external/internal network actions, increasing the chance of overbroad or unintended execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation phrases are broad enough to match many ordinary requests for images or visual content, which can cause the skill to trigger when the user did not specifically intend to use this internal API path. In this skill's context, unintended invocation is more dangerous because it may consume protected OAuth-backed resources and send prompts to an internal service without clear user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md
description: Generate images using the internal Google Antigravity API (Gemini 3 Pro Image). High quality, native generation without browser automation.
read_when:
  - User asks to generate an image
  - User wants to create visual content
metadata: {"clawdbot":{"emoji":"🎨","requires":{"bins":["node"]}}}
---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly states that it uses the user's OAuth credentials against an internal endpoint, but it does not warn users in the skill description or usage flow that their prompts and auth context will be transmitted to that service. This reduces informed consent and increases the risk of sensitive prompt content being sent to an internal API unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script reads a local auth profile file from a fixed path and extracts an OAuth access token to call a remote API. Accessing reusable local credentials is sensitive behavior because it lets the skill act with the user's existing privileges, and the manifest does not clearly disclose this credential-harvesting capability even if it is used for the advertised image-generation function.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script silently loads OAuth credentials from disk after only printing a generic message, without a clear warning that it will access and use local account tokens. In an agent skill context, undisclosed credential use is dangerous because users may invoke image generation without realizing the tool is leveraging sensitive local authentication material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script sends the user's prompt, project identifier, and client metadata to a remote Google endpoint without an explicit privacy or network warning. This is risky because prompts may contain confidential data, and the skill context does not make outbound data transfer transparency optional just because remote inference is expected.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The documentation implies direct use of a specific token source, but the implementation parses a multi-profile credential file and searches for any key beginning with "google-antigravity". That is a different credential-selection mechanism than the comment describes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The inline documentation suggests the project ID is discovered from configuration with a generic fallback behavior. In practice, the code embeds a concrete project identifier string, which changes the operational intent from neutral configuration lookup to use of a preselected project context.

Content

No source excerpt is available for this finding.