Security Audit
Sounder25/Google-Antigravity-Skills-Library:00_workspace_forensics
github.com/Sounder25/Google-Antigravity-Skills-LibraryTrust Assessment
Sounder25/Google-Antigravity-Skills-Library:00_workspace_forensics received a trust score of 33/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 4 findings: 1 critical, 2 high, 1 medium, and 0 low severity. Key findings include Potential Command Injection via --evm-binary parameter, Potential Command Injection via --test-filter parameter, Broad filesystem access combined with command execution capabilities.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 33/100, indicating areas for improvement.
Last analyzed on February 28, 2026 (commit 09376edc). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Potential Command Injection via --evm-binary parameter The skill accepts a `--evm-binary` parameter, which is described as a 'Path to the EVM executable'. The 'Safety/QA Checks' section states that the skill 'Checks if `--evm-binary` exists and runs (version check)'. If the value of `--evm-binary` is directly interpolated into a shell command (especially in the `run_eels_tests.ps1` PowerShell script) without proper escaping or validation, a malicious user could inject arbitrary commands. For example, providing `'; rm -rf /'` or `& evil.exe` could lead to arbitrary code execution on the host system. All user-provided paths and executable names must be strictly validated (e.g., check for valid path characters, ensure it points to an actual executable, not a script) and, crucially, properly quoted/escaped when used in shell commands. Consider using a safe execution mechanism that separates command arguments from the command itself, rather than string interpolation. | Static | SKILL.md:30 | |
| HIGH | Potential Command Injection via --test-filter parameter The skill accepts a `--test-filter` parameter, which is passed to `pytest`. If this string is directly interpolated into the `pytest` command within the `run_eels_tests.ps1` PowerShell script without proper escaping, a malicious user could inject arbitrary shell commands. For example, providing `-k "test_foo; rm -rf /"` could allow execution of `rm -rf /` after `pytest` is invoked (or even before, depending on how the command is constructed). The `--test-filter` value must be strictly sanitized and properly quoted/escaped when passed as an argument to `pytest` in the PowerShell script. Ensure that the argument is treated as a single literal string by the shell, preventing command chaining. | Static | SKILL.md:31 | |
| HIGH | Broad filesystem access combined with command execution capabilities The skill is designed to set up Python environments, install dependencies, and run tests, which inherently requires broad filesystem access (e.g., creating `.venv` directories, installing packages, writing reports to `--output-dir`). When combined with the identified command injection vulnerabilities in parameters like `--evm-binary` and `--test-filter`, these broad permissions significantly escalate the potential impact of an exploit, allowing an attacker to read, write, or delete arbitrary files on the host system. Implement robust input validation and sanitization for all user-provided parameters, especially those used in shell commands or filesystem operations. Where possible, restrict the skill's execution environment to the minimum necessary permissions and scope. | Static | SKILL.md:20 | |
| MEDIUM | Potential Supply Chain Risk from Unpinned Dependencies The skill description mentions "installing dependencies" as part of setting up the Python environment. If these dependencies are not explicitly pinned to specific versions (e.g., in a `requirements.txt` file), there's a risk of installing malicious or vulnerable versions if a package maintainer pushes a compromised update or if a dependency is typosquatted. While the `SKILL.md` doesn't show the `requirements.txt` or installation command, the general statement implies this risk. Ensure all Python dependencies are explicitly pinned to specific, known-good versions in a `requirements.txt` file or similar dependency manifest. Regularly audit and update dependencies. | Static | SKILL.md:20 |
Scan History
Embed Code
[](https://skillshield.io/report/1f63e0354278f402)
Powered by SkillShield