Security audit

Google Antigravity CLI

Security checks for vulnerabilities and agentic risk

Overview

This plugin is transparent about its purpose, but it delegates agent work to a signed-in local CLI with broad default tool authority and access to local Antigravity conversation history.

Install only if you are comfortable letting a third-party OpenClaw plugin drive your local signed-in agy CLI. Before use, consider setting permissionMode to sandbox or settings, disabling exposeOpenClawTools if agy should not receive OpenClaw MCP tools, and disabling sessionCatalog.enabled if past Antigravity conversations should not appear in OpenClaw surfaces.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.prompt_injection_instructions

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/agy-strip-wrapper.js:68
Evidence: const child = spawn(command, restricted?.args ?? strippedArgs, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/media-understanding.js:44
Evidence: const child = spawn(command, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/models.js:163
Evidence: const child = spawn(command, ["models"], { stdio: ["ignore", "pipe", "pipe"] });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/probe.js:18
Evidence: return spawnSync(which, [command], {

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: README.md:586
Evidence: Why this is needed rather than using OpenClaw's own system prompt: