Antigravity Image Gen

Generate images using the internal Google Antigravity API (Gemini 3 Pro Image). High quality, native generation without browser automation.

This skill is coherent with its stated purpose but handles sensitive OAuth tokens and contains an unexpected hard-coded project ID. Before installing or running it: (1) Inspect scripts/generate.js yourself (or have a trusted reviewer) to verify there are no hidden network destinations and to remove or change the fallback project ID; (2) Confirm the endpoint (daily-cloudcode-pa.sandbox.googleapis.com) and that you trust using an internal Google 'Antigravity' API; (3) Use a dedicated, limited-scope OAuth profile (not your main Google account) and consider revoking the token after use; (4) Run the script in a sandboxed environment first and monitor network/billing; (5) If you cannot validate the source or the project ID, do not provide production credentials or sensitive accounts. If you want, I can suggest specific code edits to remove the fallback project ID and limit what profile data is read.

Type: OpenClaw Skill Name: sunshine-antigravity-image-gen Version: 1.0.1 The skill reads sensitive OAuth tokens from the local `auth-profiles.json` file to authenticate requests to an internal Google sandbox API (daily-cloudcode-pa.sandbox.googleapis.com). While this behavior is documented and aligned with the stated purpose of image generation, the script (scripts/generate.js) employs high-risk patterns including direct credential access, a hardcoded project ID (junoai-465910), and spoofed headers (X-Goog-Api-Client) to interact with undocumented internal endpoints.