Hi, thanks for the project and for the clear SECURITY.md. The Security tab does not show a "Report a vulnerability" option for me, so per your fallback I am opening this issue to request a private channel rather than posting details publicly.
Summary of impact (details withheld here on purpose):
- The PreToolUse gate
hooks/validate-delegate-bash.sh, which SECURITY.md names as the only control restricting what the antigravity-delegate subagent may run via Bash, can be bypassed.
- Under prompt injection of that subagent (for example untrusted repository content, or
agy output steering it), the bypass allows arbitrary command execution with the user's privileges, and unrestricted reading of local files and environment variables piped to the external model. In other words the gate does not hold the boundary it is described as holding.
- Affected file:
hooks/validate-delegate-bash.sh. Reviewed at commit cb47ce41597ac3589549b062031cde798c7cc148, plugin version 0.23.0. A related default in scripts/agy-media.sh widens the impact.
I have a written advisory with non-destructive, exit-code-only proofs of concept (no destructive commands) and concrete suggested fixes, produced by an independent review. I would prefer to share the full detail privately so it is not public before a fix exists.
Could you either enable GitHub private vulnerability reporting on this repo or share a private contact I can send the advisory to?
Thanks.
Hi, thanks for the project and for the clear
SECURITY.md. The Security tab does not show a "Report a vulnerability" option for me, so per your fallback I am opening this issue to request a private channel rather than posting details publicly.Summary of impact (details withheld here on purpose):
hooks/validate-delegate-bash.sh, whichSECURITY.mdnames as the only control restricting what theantigravity-delegatesubagent may run via Bash, can be bypassed.agyoutput steering it), the bypass allows arbitrary command execution with the user's privileges, and unrestricted reading of local files and environment variables piped to the external model. In other words the gate does not hold the boundary it is described as holding.hooks/validate-delegate-bash.sh. Reviewed at commitcb47ce41597ac3589549b062031cde798c7cc148, plugin version0.23.0. A related default inscripts/agy-media.shwidens the impact.I have a written advisory with non-destructive, exit-code-only proofs of concept (no destructive commands) and concrete suggested fixes, produced by an independent review. I would prefer to share the full detail privately so it is not public before a fix exists.
Could you either enable GitHub private vulnerability reporting on this repo or share a private contact I can send the advisory to?
Thanks.