Skip to content

Fix ag-ask slash command shell injection #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
study8677 wants to merge 1 commit into from
Closed

Fix ag-ask slash command shell injection #82

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 7 additions & 23 deletions commands/ag-ask.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,34 +1,18 @@
---
description: Ask a question about the current project's codebase via the antigravity knowledge hub. / 通过 antigravity 知识库询问当前项目代码。
allowed-tools: ["Bash"]
allowed-tools: ["mcp__plugin_antigravity_antigravity__ask_project"]

@chatgpt-codex-connector chatgpt-codex-connector Bot May 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep a non-MCP execution path for /ag-ask

Restricting allowed-tools to mcp__plugin_antigravity_antigravity__ask_project makes the slash command unusable in installs where ag-mcp is not registered or connected, even though the project currently documents MCP as optional (see README.md and INSTALL.md) and previously supported a CLI fallback. In this state, /ag-ask has no runnable tool in non-MCP environments and the existing packaging expectation (engine/tests/test_plugin_packaging.py::test_slash_commands_run_cli_without_mcp_tools) already fails, so this change introduces a functional regression for users not using MCP.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot May 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Use the configured MCP server name in tool allowlist

The command hard-codes mcp__plugin_antigravity_antigravity__ask_project, which does not match the repo’s documented manual MCP setup where the server is named antigravity (docs/examples/antigravity.mcp.json). For that setup, the callable tool name is mcp__antigravity__ask_project, so users who correctly configure MCP via the documented .mcp.json path will still have this command target a non-existent tool.

Useful? React with 👍 / 👎.

---

Run the Antigravity CLI for the current workspace:
Use the `mcp__plugin_antigravity_antigravity__ask_project` MCP tool to answer:

通过 Antigravity CLI 询问当前工作区：
使用 `mcp__plugin_antigravity_antigravity__ask_project` MCP 工具回答：

> $ARGUMENTS

Use Bash:
If the MCP tool is not available or not connected, tell the user to restart Claude Code once so the Antigravity MCP server loads, then rerun the command. Do not diagnose missing MCP tools as an LLM key problem.

@chatgpt-codex-connector chatgpt-codex-connector Bot May 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Replace Claude-only restart guidance with host-agnostic recovery

The new fallback path hard-codes “restart Claude Code” when the MCP tool is missing, but this command is shipped for both Claude and Codex hosts, and missing-tool cases in Codex or in unregistered MCP setups are not resolved by restarting Claude Code. This creates a dead-end troubleshooting path where users can repeatedly retry without ever being directed to a valid setup or fallback route.

Useful? React with 👍 / 👎.


```bash
AG_ASK_TIMEOUT_SECONDS="${AG_ASK_TIMEOUT_SECONDS:-120}" ag-ask "$ARGUMENTS" --workspace "$PWD"
```
如果 MCP 工具不可用或未连接，请告诉用户完整重启 Claude Code 一次，让 Antigravity MCP server 加载完成，然后重新运行本命令。不要把缺失 MCP 工具判断为 LLM API key 问题。

使用 Bash：
Prefer this tool over manual file search. If the tool returns insufficient detail, follow up with targeted Read/Grep.

```bash
AG_ASK_TIMEOUT_SECONDS="${AG_ASK_TIMEOUT_SECONDS:-120}" ag-ask "$ARGUMENTS" --workspace "$PWD"
```

If `ag-ask` is not found, tell the user the engine CLI is not installed and suggest:

如果找不到 `ag-ask`，说明 engine CLI 尚未安装，建议用户运行：

```bash
pipx install "git+https://github.com/study8677/antigravity-workspace-template.git#subdirectory=engine"
```

Prefer `ag-ask` over manual file search. If the answer returns insufficient detail, follow up with targeted Read/Grep.

优先使用 `ag-ask`，不要先手动搜索文件。如果返回的信息不够，再用有目标的 Read/Grep 补充。
优先使用该工具，不要先手动搜索文件。如果工具返回的信息不够，再用有目标的 Read/Grep 补充。
Loading