Fix ag-ask slash command shell injection - #82
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 41c7507a01
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| --- | ||
| description: Ask a question about the current project's codebase via the antigravity knowledge hub. / 通过 antigravity 知识库询问当前项目代码。 | ||
| allowed-tools: ["Bash"] | ||
| allowed-tools: ["mcp__plugin_antigravity_antigravity__ask_project"] |
There was a problem hiding this comment.
Restricting allowed-tools to mcp__plugin_antigravity_antigravity__ask_project makes the slash command unusable in installs where ag-mcp is not registered or connected, even though the project currently documents MCP as optional (see README.md and INSTALL.md) and previously supported a CLI fallback. In this state, /ag-ask has no runnable tool in non-MCP environments and the existing packaging expectation (engine/tests/test_plugin_packaging.py::test_slash_commands_run_cli_without_mcp_tools) already fails, so this change introduces a functional regression for users not using MCP.
Useful? React with 👍 / 👎.
| > $ARGUMENTS | ||
|
|
||
| Use Bash: | ||
| If the MCP tool is not available or not connected, tell the user to restart Claude Code once so the Antigravity MCP server loads, then rerun the command. Do not diagnose missing MCP tools as an LLM key problem. |
There was a problem hiding this comment.
The new fallback path hard-codes “restart Claude Code” when the MCP tool is missing, but this command is shipped for both Claude and Codex hosts, and missing-tool cases in Codex or in unregistered MCP setups are not resolved by restarting Claude Code. This creates a dead-end troubleshooting path where users can repeatedly retry without ever being directed to a valid setup or fallback route.
Useful? React with 👍 / 👎.
| --- | ||
| description: Ask a question about the current project's codebase via the antigravity knowledge hub. / 通过 antigravity 知识库询问当前项目代码。 | ||
| allowed-tools: ["Bash"] | ||
| allowed-tools: ["mcp__plugin_antigravity_antigravity__ask_project"] |
There was a problem hiding this comment.
The command hard-codes mcp__plugin_antigravity_antigravity__ask_project, which does not match the repo’s documented manual MCP setup where the server is named antigravity (docs/examples/antigravity.mcp.json). For that setup, the callable tool name is mcp__antigravity__ask_project, so users who correctly configure MCP via the documented .mcp.json path will still have this command target a non-existent tool.
Useful? React with 👍 / 👎.
1 participant
Motivation
/antigravity:ag-askslash command grantedBashand executed a shell line that interpolated raw$ARGUMENTS, allowing shell metacharacters and command substitution to run as the local user.Description
allowed-tools: ["Bash"]withallowed-tools: ["mcp__plugin_antigravity_antigravity__ask_project"]incommands/ag-ask.mdto restrict the command to the MCP tool.AG_ASK_TIMEOUT_SECONDS="${AG_ASK_TIMEOUT_SECONDS:-120}" ag-ask "$ARGUMENTS" --workspace "$PWD"and the related CLI-install guidance from the command definition.Testing
Codex Task