Antigravity Image Gen 1.0.0

• Outcome: Review
• Latest audit: May 28, 2026 · 1:09 PM UTC
• Version: 1.0.0

Overview

This skill likely generates images, but it uses stored Google Antigravity credentials against an internal endpoint and includes client-spoofing bypass behavior that users should review first.

Install only if you trust the publisher and intentionally want this skill to use your local Google Antigravity OAuth profile. Use explicit safe output paths, avoid sensitive prompt contents, confirm which account and project the auth profile uses, and prefer a supported public image-generation API if internal endpoint use or deprecation-bypass client metadata is unacceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill metadata does not declare permissions, yet the described behavior and associated analysis indicate access to environment-derived capabilities and local OAuth material. Hidden capability use reduces transparency and prevents users or the platform from making an informed trust decision before the skill reads sensitive data or makes authenticated requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as an image-generation helper, but the behavior includes reading sensitive OAuth credentials from a local auth-profiles file, using them to call an internal endpoint, and writing files locally. That mismatch is dangerous because users may invoke it expecting harmless media generation while it silently accesses privileged local secrets and authenticated internal services.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script reads a local auth profile containing access tokens from a fixed path and uses those credentials to call an internal Google API. While credential access is functionally related to the image-generation feature, it is still sensitive because it silently consumes unrelated local secrets from the host environment rather than using explicit user-provided auth or a scoped secret mechanism.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The code comment and headers indicate deliberate spoofing of client/version metadata to 'bypass deprecation checks.' Misrepresenting client identity to access an internal endpoint can evade platform controls and compatibility safeguards, which is a strong indicator of unsafe behavior beyond normal image generation.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation conditions are broad enough that ordinary requests to create visual content could trigger the skill automatically. Because the skill appears to use local OAuth credentials and an internal API, over-broad invocation increases the chance of unintended authenticated actions without clear user awareness.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill reads a sensitive credential file with only an internal log message and no clear user-facing disclosure or consent. In an agent environment, silent credential consumption is dangerous because users may not realize the skill is accessing local tokens and could unintentionally authorize use of privileged internal accounts.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The script sends the user's prompt to a remote API without a clear privacy warning. This is common for cloud-backed generation tools, but it is still a real privacy issue because users may enter confidential data into prompts without understanding that the content leaves the local environment.

VirusTotal

66/66 vendors flagged this skill as clean.