OpenClaw Antigravity Sync Skill

• Outcome: Pass
• Latest audit: May 28, 2026, 12:54 PM
• Version:
  1.0.0

Overview

This skill appears to do what it says: use your Google Antigravity login to fetch model/quota data and update OpenClaw model settings, with a backup created first.

Install and run this only if you want it to use your existing Google Antigravity authentication and update your OpenClaw model configuration. After running, review ~/.openclaw/openclaw.json and keep the .bak backup until you confirm the selected default model is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrase "update models" is generic and likely to overlap with ordinary user requests that are not intended to invoke this skill. Because the skill performs authenticated discovery and rewrites configuration, accidental invocation could cause unintended API calls and configuration changes, making this broader trigger materially risky in context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script backs up and then silently modifies the user's ~/.openclaw/openclaw.json without explicit confirmation, dry-run output, or scoped patching. In an agent-skill context, unexpected configuration mutation is dangerous because it can alter provider settings and default model selection in ways the user did not knowingly approve, potentially disrupting service or changing security-relevant behavior.

VirusTotal

63/63 vendors flagged this skill as clean.