Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it claims: it uses an existing Google Antigravity login to fetch model data and update OpenClaw model configuration, with some configuration-change risk users should understand.
Install only if you want a skill that can use your existing Google Antigravity OAuth session to query Google model availability and rewrite your OpenClaw model configuration. Review the backup file if the selected default model changes unexpectedly, and invoke it with a specific request such as syncing Antigravity models rather than a generic model-update request.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const profile = profiles[antigravityProfileKey];
if (!profile.access) {
console.error("❌ Auth profile found but no access token present.");
process.exit(1);
}
The trigger phrase "update models" is broad enough to match ordinary user requests that may not clearly imply permission to run a configuration-changing skill. In this skill's context, accidental invocation is more dangerous because the documented behavior includes querying external APIs and modifying openclaw.json, which can cause unintended configuration changes.
The script reads a locally stored OAuth access token and project ID, then sends them to a remote Google endpoint without any explicit user-facing consent or warning at runtime. Even if this is needed for functionality, silently using credentials and transmitting account context increases the risk of unexpected credential use, especially in an agent skill where users may not inspect the code before execution.
The script modifies the user's openclaw.json in place without prompting for confirmation, which can unexpectedly change agent behavior and break existing configurations. Although it creates a backup, that does not prevent harmful or surprising changes when the skill is executed automatically or non-interactively.
The manifest says this skill automatically discovers and configures Google Antigravity models and quotas. In addition to that, the code inspects config.channels.whatsapp and evaluates bot exposure settings, which is a separate messaging-channel security capability unrelated to model syncing.
The skill documentation explains behavior, but it does not prominently warn users up front that running the skill will modify openclaw.json. This can mislead users into treating it as a read-only discovery action, increasing the chance of uninformed execution and unintended local configuration changes.
No suspicious patterns detected.