invoking-antigravity — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited invoking-antigravity (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run Google's Antigravity CLI (agy) headless, then call agy -p "<task>" as an orchestrated sub-agent on Google's harness (Gemini 3.5 Flash).
Install, authenticate once, orchestrate. For the why behind any step — the 30 s timeout, the keyring fallback, the token format, network hosts, troubleshooting — read references/auth-internals.md.
agy as a sub-agent: shell out, capture stdout, fold back.For interactive local use, skip this — run agy directly and it opens a browser.
curl -fsSL https://antigravity.google/cli/install.sh | bashIdempotent, ~3 s, installs ~/.local/bin/agy.
Export these in every shell that runs agy, so it stores the token in a file rather than an OS keyring:
export SSH_CONNECTION="203.0.113.1 50000 203.0.113.2 22"
export SSH_CLIENT="203.0.113.1 50000 22"
export SSH_TTY="/dev/pts/0"Run the broker, then relay the login to a human:
python3 scripts/agy_auth_broker.py & # spawns agy, captures the OAuth URL
sleep 15 && cat /tmp/agybroker/url # a human opens this and consents
printf '<code>' > /tmp/agybroker/code # paste the authorization code backagy writes the token to ~/.gemini/antigravity-cli/antigravity-oauth-token; later agy -p calls run silently. Complete the login within a few minutes — an idle container pause kills the broker's agy process.
agy --dangerously-skip-permissions -p "<task>"Place every flag before -p — it treats the next argument as the prompt. Add --add-dir <path>, --print-timeout 10m, or --conversation <id> as the task needs.
Save ~/.gemini/antigravity-cli/antigravity-oauth-token and write it back (with the SSH vars set) — its refresh_token is durable, so no repeat OAuth. Keep the file out of git and logs; it is a personal Google credential.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.