ClawHub
Back to skill

Security audit

antigravity-cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent documentation for Antigravity CLI, but its install instructions ask users to execute remote installer scripts directly without verification.

Install only if you trust the publisher and the Antigravity CLI distribution path. Before running the documented installer commands, prefer downloading the script first, reviewing it, and verifying an official checksum or signature; do not run the installer with elevated privileges unless the vendor explicitly requires it. Keep sandboxing and permission prompts enabled for unfamiliar repositories.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/cli-usage.md:58
Finding

Unverified Remote Installation Scripts Are Downloaded and Executed

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The documentation explicitly instructs users to fetch and execute a shell script from the network in one step. This is dangerous because it bypasses meaningful inspection and makes compromise of the hosting endpoint, DNS/TLS trust chain, or accidental URL substitution immediately lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · references/cli-usage.md (reported line 58)May include surrounding context.

Mac/Linux:

bash
curl -fsSL https://antigravity.google/cli/install.sh | bash

Windows PowerShell:

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The | bash construct chains untrusted network content directly into a shell, removing the opportunity for review and amplifying the impact of any compromise into immediate command execution. In an installation guide for a developer CLI, users are especially likely to copy-paste the command as-is, which increases exploitability.

Content

Scanner excerpt · references/cli-usage.md (reported line 58)May include surrounding context.

Mac/Linux:

bash
curl -fsSL https://antigravity.google/cli/install.sh | bash

Windows PowerShell:

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/cli-usage.md (reported line 31)May include surrounding context.

md
| `--disable-slash-commands`       |       | Disable slash command and skill expansion in print mode                       |
| `--project` / `--new-project`    |       | Project ID or create a new project for the current CLI session                |
| `--sandbox`                      |       | Run with terminal sandbox restrictions enabled                                |
| `--dangerously-skip-permissions` |       | Auto-approve all tool requests without prompting                              |
| `--add-dir <path>`               |       | Add a workspace directory; repeatable                                         |
| `--log-file <path>`              |       | Override log file location                                                    |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The --dangerously-skip-permissions flag is documented as auto-approving all tool requests, but the text does not warn that this disables an important safety barrier and can permit unintended command execution, file modification, or data access without user confirmation. In an agent CLI, documenting this as a normal flag without prominent caution makes risky use more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file provides copy-paste installation commands that execute remotely fetched scripts directly (curl | bash, irm ... | iex) without any warning, checksum/signature verification guidance, or recommendation to inspect the script first. In a CLI-installation context this materially increases the chance that users execute tampered, spoofed, or unexpectedly system-modifying code with full user privileges.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/config-platform.md (reported line 54)May include surrounding context.

md
- Preferences, permissions, and security config synchronize between CLI and Antigravity 2.0.
- Active CLI conversations can be exported to Antigravity 2.0 for visual orchestration.
- Native SSH, tmux, and terminal multiplexer workflows are supported for headless/server use.
- The main agent controls which tools and permissions subagents receive, including MCP tool access and file write capabilities.

## Auth and first launch

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/security-permissions.md (reported line 9)May include surrounding context.

md
- `deny`: block immediately.
- `ask`: pause and request explicit approval.
- `allow`: auto-approve.

Precedence is strict: `deny` wins over `ask`, and `ask` wins over `allow`.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown states that a ! prefix runs terminal commands directly in the prompt, which can affect the user's system, files, or processes. The surrounding documentation does not include any warning or caution about the risks of executing shell commands from within the TUI.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The file encourages users to paste screenshots, recordings, and other rich media into the CLI, which may include sensitive or personal information. There is no accompanying warning about reviewing clipboard contents before submission or the privacy implications of sharing media with the tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.