ΠΠ°Π²ΡΠΊΠΈ agy-worker
π¦
agy-worker
v0.21.0 Π Π΅Π²ΠΈΠ·ΠΈΡ ΡΠΎΠ΄Π΅ΡΠΆΠΈΠΌΠΎΠ³ΠΎ r8 ΠΡΡΠΎΠΊΠΈΠΉ ΡΠΈΡΠΊ βοΈ ΠΠ½Π΅ΡΠ½ΠΈΠ΅ ΠΊΠΎΠΌΠ°Π½Π΄Ρπ ΠΠΎΡΡΡΠΏ ΠΊ ΡΠ΅ΡΠΈπ ΠΠΎΡΡΡΠΏ ΠΊ ΡΠ°ΠΉΠ»ΠΎΠ²ΠΎΠΉ ΡΠΈΡΡΠ΅ΠΌΠ΅β‘ Π‘ΠΎΠ΄Π΅ΡΠΆΠΈΡ ΡΠΊΡΠΈΠΏΡΡπ ΠΠ΅ΡΠ΅ΠΌΠ΅Π½Π½ΡΠ΅ ΠΎΠΊΡΡΠΆΠ΅Π½ΠΈΡ
Delegate Repository Work Safely
Repository delegation can consume time and make verification inconsistent. This skill sends bounded work to agy, then keeps review, checks, repair, and acceptance with Codex.
ΠΠΎΠ΄Π΄Π΅ΡΠΆΠΈΠ²Π°Π΅Ρ: Codex
ΠΡΡΠ°Π½ΠΎΠ²ΠΈΡΠ΅ΡΡ ΠΈ Π·Π°ΠΏΡΠΎΡΠΈΡΠ΅ ΠΏΠΎΠ΄ΡΠ²Π΅ΡΠΆΠ΄Π΅Π½ΠΈΠ΅ ΠΏΠ΅ΡΠ΅Π΄ ΡΡΡΠ°Π½ΠΎΠ²ΠΊΠΎΠΉ.
ΠΡΠΎΠ²Π΅ΡΡΡΠ΅ ΠΏΠ»Π°Π½ ΠΈ ΠΏΠΎΠ»ΡΡΠΈΡΠ΅ ΡΠ²Π½ΠΎΠ΅ ΡΠΎΠ³Π»Π°ΡΠΈΠ΅ ΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°ΡΠ΅Π»Ρ ΠΏΠ΅ΡΠ΅Π΄ ΠΈΠ·ΠΌΠ΅Π½Π΅Π½ΠΈΠ΅ΠΌ ΡΠ°ΠΉΠ»ΠΎΠ².
Π£ΡΡΠ°Π½ΠΎΠ²ΠΈΡΡ Ρ ΠΏΠΎΠΌΠΎΡΡΡ ΠΌΠΎΠ΅Π³ΠΎ ΠΠ³Π΅Π½ΡΠ°
Π‘ΠΊΠΎΠΏΠΈΡΡΠΉΡΠ΅ ΡΡΠΎΡ Π·Π°ΠΏΡΠΎΡ Π² ΡΠ²ΠΎΠ΅Π³ΠΎ ΠΠ³Π΅Π½ΡΠ°. ΠΠ½ ΡΠΎΠ΄Π΅ΡΠΆΠΈΡ ΠΊΠ°Π½ΠΎΠ½ΠΈΡΠ΅ΡΠΊΡΡ ΡΡΡΠ°Π½ΠΈΡΡ Skill ΠΈ ΠΌΠ°Π½ΠΈΡΠ΅ΡΡ.
ΠΠ°ΠΏΡΠΎΡ Π°Π³Π΅Π½ΡΠ°
Review the Skillstore skill "agy-worker" from https://skillstore.io/skills/cagdasyurekli-agy-worker.md and its manifest at https://skillstore.io/api/skills/cagdasyurekli-agy-worker/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.ΠΠ°Ρ ΠΠ³Π΅Π½Ρ ΠΏΠΎ-ΠΏΡΠ΅ΠΆΠ½Π΅ΠΌΡ Π΄ΠΎΠ»ΠΆΠ΅Π½ ΠΏΠΎΠΊΠ°Π·Π°ΡΡ ΠΏΠ»Π°Π½ ΠΈ Π·Π°ΠΏΡΠΎΡΠΈΡΡ Π²ΡΠ΅ ΠΏΠΎΠ΄ΡΠ²Π΅ΡΠΆΠ΄Π΅Π½ΠΈΡ, ΡΡΠ΅Π±ΡΠ΅ΠΌΡΠ΅ ΠΏΠΎΠ»ΠΈΡΠΈΠΊΠΎΠΉ Π±Π΅Π·ΠΎΠΏΠ°ΡΠ½ΠΎΡΡΠΈ.
Π Π΅ΡΡΡΡΡ Π΄Π»Ρ AI-Π°Π³Π΅Π½ΡΠΎΠ²
ΠΡΠΏΠΎΠ»ΡΠ·ΡΠΉΡΠ΅ ΡΡΠΈ ΡΡΡΠ»ΠΊΠΈ, ΠΊΠΎΠ³Π΄Π° AI-Π°Π³Π΅Π½ΡΡ, crawler ΠΈΠ»ΠΈ script Π½ΡΠΆΠ΅Π½ ΡΠΈΡΡΡΠΉ ΠΊΠΎΠ½ΡΠ΅ΠΊΡΡ Π²ΠΌΠ΅ΡΡΠΎ ΠΏΠΎΠ»Π½ΠΎΠΉ ΡΡΡΠ°Π½ΠΈΡΡ.
ΠΡΠΎΡΠ΅ΡΡΠΈΡΠΎΠ²Π°ΡΡ
ΠΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅ Β«agy-workerΒ». Explore the authentication flow and identify the files that handle token validation.
ΠΠΆΠΈΠ΄Π°Π΅ΠΌΡΠΉ ΡΠ΅Π·ΡΠ»ΡΡΠ°Ρ:
- Mapped the authentication entry points and token validation path.
- Listed evidence files and marked unverified assumptions for Codex review.
ΠΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅ Β«agy-workerΒ». Add parser error-path tests under tests/parser and verify the change.
ΠΠΆΠΈΠ΄Π°Π΅ΠΌΡΠΉ ΡΠ΅Π·ΡΠ»ΡΡΠ°Ρ:
- Implemented the focused tests within the approved path.
- Ran the relevant test command and reported the final candidate status.
ΠΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅ Β«agy-workerΒ». Audit the repository workflow and repair bounded failures.
ΠΠΆΠΈΠ΄Π°Π΅ΠΌΡΠΉ ΡΠ΅Π·ΡΠ»ΡΡΠ°Ρ:
Returned a structured project result with the candidate diff, verification evidence, remaining limits, and delivery recommendation.
ΠΡΠ΄ΠΈΡ Π±Π΅Π·ΠΎΠΏΠ°ΡΠ½ΠΎΡΡΠΈ
ΠΡΡΠΎΠΊΠΈΠΉ ΡΠΈΡΠΊv8 β’ 20.09.2026 ΠΡΠΊΡΡΡΡ Π²Π΅ΡΡΠΈΠΎΠ½Π½ΡΠΉ ΠΎΡΡΠ΅Ρ
Most static matches are benign implementation, validation, documentation, schema, or control-character checks. Confirmed risks include provider and verifier execution, environment inheritance, keychain handling, settings access, and non-sandboxed provider authority. Static review was capped at 400/991 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
92
ΠΡΠΎΡΠΊΠ°Π½ΠΈΡΠΎΠ²Π°Π½ΠΎ ΡΠ°ΠΉΠ»ΠΎΠ²
39,230
ΠΡΠΎΠ°Π½Π°Π»ΠΈΠ·ΠΈΡΠΎΠ²Π°Π½ΠΎ ΡΡΡΠΎΠΊ
50
ΠΡΠ½ΠΊΡΡ ΠΏΡΠΎΠ²Π΅ΡΠΊΠΈ
0
ΠΠΎΠΆΠ½ΡΠ΅ ΡΡΠ°Π±Π°ΡΡΠ²Π°Π½ΠΈΡ ΠΏΡΠΎΠΈΠ³Π½ΠΎΡΠΈΡΠΎΠ²Π°Π½Ρ
ΠΠΎΠ΄ΡΠ²Π΅ΡΠΆΠ΄ΡΠ½Π½ΡΠ΅ ΠΏΡΠΎΠ±Π»Π΅ΠΌΡ Π±Π΅Π·ΠΎΠΏΠ°ΡΠ½ΠΎΡΡΠΈ (7)
ΠΡΡΠΎΠΊΠΈΠΉ
Certificate/key files
keychain_path=prepared.keychain.path if prepared.keychain is not None else None,
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
ΠΡΡΠΎΠΊΠΈΠΉ
Certificate/key files
if prepared.keychain is None or prepared.keychain_preferences is None:
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
ΠΡΡΠΎΠΊΠΈΠΉ
Certificate/key files
if _bind_keychain(prepared.keychain.path) != prepared.keychain:
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
ΠΡΡΠΎΠΊΠΈΠΉ
Certificate/key files
prepared.keychain_preferences.path, modes={0o600}, limit=MAX_PROFILE_BYTES,
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
ΠΡΡΠΎΠΊΠΈΠΉ
Certificate/key files
) != prepared.keychain_preferences:
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
ΠΡΡΠΎΠΊΠΈΠΉ
Certificate/key files
prepared.keychain is not None or prepared.keychain_preferences is not None
The code binds a prepared keychain path or keychain preferences file, which is a sensitive-resource capability. It is used for native isolation, but compromise of the boundary could expose credential material.
ΠΡΡΠΎΠΊΠΈΠΉ
External Provider Transmission Without Host Isolation
The skill can transmit a whole disposable worktree to Google or Gemini, while default session mode retains normal user filesystem and network authority without host containment.
The documented workflow explicitly states both the external transmission boundary and the lack of sandbox or native containment in default session mode.
ΠΡΠ½ΠΊΡΡ ΠΏΡΠΎΠ²Π΅ΡΠΊΠΈ Π²ΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎΡΡΠ΅ΠΉ (50)
ΠΡΠΎ ΡΠ΅Π°Π»ΡΠ½ΡΠ΅ Π»ΠΎΠΊΠ°Π»ΡΠ½ΡΠ΅ Π²ΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎΡΡΠΈ, ΠΊΠΎΡΠΎΡΡΠ΅ ΠΌΠΎΠ³ΡΡ ΠΎΠΆΠΈΠ΄Π°ΡΡΡΡ Π΄Π»Ρ ΡΡΠΎΠ³ΠΎ Π½Π°Π²ΡΠΊΠ°, ΠΏΠΎΡΡΠΎΠΌΡ ΠΎΠ½ΠΈ ΡΡΠ΅Π±ΡΡΡ ΠΏΡΠΎΠ²Π΅ΡΠΊΠΈ, Π½ΠΎ Π½Π΅ ΡΡΠΈΡΠ°ΡΡΡΡ ΠΏΠΎΠ΄ΡΠ²Π΅ΡΠΆΠ΄ΡΠ½Π½ΡΠΌ Π²ΡΠ΅Π΄ΠΎΠ½ΠΎΡΠ½ΡΠΌ ΠΏΠΎΠ²Π΅Π΄Π΅Π½ΠΈΠ΅ΠΌ.
ΠΡΡΠΎΠΊΠΈΠΉ
Hidden file in home directory
p = os.path.expanduser("~/.gemini/antigravity-cli/settings.json")
The account-phase helper expands and reads the user settings file under ~/.gemini. This accesses provider configuration that may contain sensitive permissions or account settings.
ΠΡΡΠΎΠΊΠΈΠΉ
Process spawn
return spawn(job, "initial", resume=False, foreground=True)
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Process spawn
return spawn(job, "initial", resume=False, foreground=False)
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Process spawn
return spawn(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Process spawn
return spawn(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python os.exec variants
os.execvpe(command[0], command, dict(os.environ))
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.Popen
child = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.Popen
controller_process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.Popen
process = subprocess.Popen(argv, cwd=cwd, env=git_env(), stdin=subprocess.DEVNULL, stdout=subprocess
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.Popen
process = subprocess.Popen(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
return subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
provider_checked = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
canonical_checked = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
result = subprocess.run(command, cwd=cwd, env=git_env(), stdin=subprocess.DEVNULL, stdout=subprocess
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
completed = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
completed = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
return subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
proc = subprocess.run(verify_cmd, check=False)
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
ΠΡΡΠΎΠΊΠΈΠΉ
Python subprocess.run
fin_proc = subprocess.run(
The runtime launches provider, Git, or verification processes. This is required by the skill, but it creates a real command-execution boundary that must remain approval-bound.
Π‘ΡΠ΅Π΄Π½ΠΈΠΉ
Hidden file access
p = os.path.expanduser("~/.gemini/antigravity-cli/settings.json")
The account-phase helper expands and reads the user settings file under ~/.gemini. This accesses provider configuration that may contain sensitive permissions or account settings.
Π‘ΡΠ΅Π΄Π½ΠΈΠΉ
Unix shell invocation
/bin/bash -c "${verify_specs[$i]}"
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Π‘ΡΠ΅Π΄Π½ΠΈΠΉ
Unix shell invocation
/bin/bash -c "${verify_specs[$i]}"
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Π‘ΡΠ΅Π΄Π½ΠΈΠΉ
Unix shell invocation
SCRIPT_SHELLS = frozenset({"/bin/bash", "/bin/sh"})
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Π‘ΡΠ΅Π΄Π½ΠΈΠΉ
Unix shell invocation
"/bin/sh", "-c", supervisor, "bounded-git-supervisor",
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
Π‘ΡΠ΅Π΄Π½ΠΈΠΉ
Unix shell invocation
"/bin/bash",
The verifier invokes a shell or defines a shell supervisor. Shell execution can run arbitrary commands, so this is a real execution boundary even with the documented controls.
ΠΠΈΠ·ΠΊΠΈΠΉ
Python environment access
environment = os.environ.copy()
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
ΠΠΈΠ·ΠΊΠΈΠΉ
Python environment access
if name in os.environ:
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
ΠΠΈΠ·ΠΊΠΈΠΉ
Python environment access
(os.fsencode(name), b"\0", os.fsencode(os.environ[name]), b"\0")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
ΠΠΈΠ·ΠΊΠΈΠΉ
Python environment access
os.execvpe(command[0], command, dict(os.environ))
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
ΠΠΈΠ·ΠΊΠΈΠΉ
Python environment access
environment = os.environ.copy()
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
ΠΠΈΠ·ΠΊΠΈΠΉ
Python environment access
environment = {name: os.environ[name] for name in allowed if name in os.environ}
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
ΠΠΈΠ·ΠΊΠΈΠΉ
Python environment access
configured = os.environ.get("XDG_STATE_HOME")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
ΠΠΈΠ·ΠΊΠΈΠΉ
Python environment access
home_text = os.environ.get("HOME")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
ΠΠΈΠ·ΠΊΠΈΠΉ
Python environment access
environment = dict(os.environ)
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
ΠΠΈΠ·ΠΊΠΈΠΉ
Python environment access
env = dict(os.environ)
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
ΠΠΈΠ·ΠΊΠΈΠΉ
Python environment access
os.environ.get("AGY_WORKER_LOG_DIR") or (state_path.parent / "logs")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
ΠΠΈΠ·ΠΊΠΈΠΉ
Python environment access
os.environ.get("AGY_WORKER_LOG_DIR") or (SCRIPTS.parent / "logs")
The code reads or copies the process environment for child execution. Environment variables can contain credentials, so filtering must remain complete and approval-bound.
Π€Π°ΠΊΡΠΎΡΡ ΡΠΈΡΠΊΠ°
βοΈ ΠΠ½Π΅ΡΠ½ΠΈΠ΅ ΠΊΠΎΠΌΠ°Π½Π΄Ρ (50)
README.md:56 references/PROJECT_LIFECYCLE_AND_VERIFICATION.md:71 references/PROJECT_LIFECYCLE_AND_VERIFICATION.md:80 references/PROJECT_LIFECYCLE_AND_VERIFICATION.md:81 references/PROJECT_LIFECYCLE_AND_VERIFICATION.md:82 references/PROJECT_LIFECYCLE_AND_VERIFICATION.md:252 references/PROJECT_LIFECYCLE_AND_VERIFICATION.md:253 references/PROJECT_LIFECYCLE_AND_VERIFICATION.md:287 references/PROJECT_LIFECYCLE_AND_VERIFICATION.md:288-290 runtime/agy-worker.sh:14 runtime/agy-worker.sh:15 runtime/agy-worker.sh:1262 runtime/agy-worker.sh:1263 runtime/agy-worker.sh:1300 runtime/agy-worker.sh:25 runtime/agy-worker.sh:30 runtime/agy-worker.sh:237 runtime/agy-worker.sh:464 runtime/agy-worker.sh:473-475 runtime/agy-worker.sh:497 runtime/agy-worker.sh:498 runtime/agy-worker.sh:499 runtime/agy-worker.sh:603 runtime/agy-worker.sh:604 runtime/agy-worker.sh:649 runtime/agy-worker.sh:650 runtime/agy-worker.sh:651 runtime/agy-worker.sh:652 runtime/agy-worker.sh:663 runtime/agy-worker.sh:685 runtime/agy-worker.sh:690 runtime/agy-worker.sh:692 runtime/agy-worker.sh:696 runtime/agy-worker.sh:720-725 runtime/agy-worker.sh:901-906 runtime/agy-worker.sh:980 runtime/agy-worker.sh:1009-1011 runtime/agy-worker.sh:1043-1054 runtime/agy-worker.sh:1225 runtime/agy-worker.sh:1226 runtime/agy-worker.sh:1306 runtime/agy-worker.sh:15-1262 runtime/benchmark.sh:5 runtime/codex-usage-report.sh:5 runtime/delegation-policy.sh:5 runtime/doctor.sh:21 runtime/doctor.sh:32 runtime/doctor.sh:37-38 runtime/doctor.sh:85-86 runtime/doctor.sh:146-147
π ΠΠΎΡΡΡΠΏ ΠΊ ΡΠ΅ΡΠΈ (43)
references/PROJECT_LIFECYCLE_AND_VERIFICATION.md:25 runtime/compat/agy-version-manifest.json:20 runtime/compat/agy-version-manifest.json:64 runtime/compat/agy-version-manifest.json:111 runtime/compat/agy-version-manifest.json:163 runtime/compat/agy-version-manifest.json:212 runtime/compat/agy-version-manifest.json:257 runtime/compat/agy-version-manifest.json:277 runtime/compat/agy-version-manifest.json:303 runtime/compat/agy-version-manifest.json:347 runtime/compat/model-effort-matrix.schema.json:2 runtime/compat/model-effort-matrix.schema.json:3 runtime/compat/version-manifest.schema.json:2 runtime/schemas/benchmark-plan.schema.json:1 runtime/schemas/benchmark-result.schema.json:1 runtime/schemas/delegation-policy.schema.json:2 runtime/schemas/evidence-receipt.schema.json:2 runtime/schemas/job-state.schema.json:2 runtime/schemas/model-evidence-campaign-advisory-preview.schema.json:2 runtime/schemas/model-evidence-campaign-advisory-summary.schema.json:2 runtime/schemas/model-evidence-campaign-aggregate-preview.schema.json:2 runtime/schemas/model-evidence-campaign-aggregate.schema.json:2 runtime/schemas/model-evidence-campaign-evaluation.schema.json:2 runtime/schemas/model-evidence-campaign-plan.schema.json:2 runtime/schemas/model-evidence-campaign-record.schema.json:2 runtime/schemas/model-evidence-campaign-record.schema.json:156 runtime/schemas/model-intelligence-advisory.schema.json:2 runtime/schemas/model-intelligence-evidence.schema.json:2 runtime/schemas/model-intelligence-evidence.schema.json:85 runtime/schemas/model-recommendation.schema.json:2 runtime/schemas/model-selection.schema.json:2 runtime/schemas/swebench-workflow-study-advisory.schema.json:1 runtime/schemas/swebench-workflow-study-report.schema.json:1 runtime/schemas/worker-result.provider.schema.json:2 runtime/schemas/worker-result.schema.json:2 runtime/schemas/workflow-state.schema.json:2 runtime/scripts/codex_usage_report.py:726 runtime/scripts/compatibility.py:245 runtime/scripts/compatibility.py:246 runtime/scripts/feedback-triage.py:31 runtime/scripts/model_evidence_campaign.py:28 runtime/scripts/model_intelligence.py:26 SKILL.md:36
π ΠΠΎΡΡΡΠΏ ΠΊ ΡΠ°ΠΉΠ»ΠΎΠ²ΠΎΠΉ ΡΠΈΡΡΠ΅ΠΌΠ΅ (50)
references/PROJECT_LIFECYCLE_AND_VERIFICATION.md:81 references/PROJECT_LIFECYCLE_AND_VERIFICATION.md:82 references/PROJECT_LIFECYCLE_AND_VERIFICATION.md:252 references/SECURITY_AND_COMPATIBILITY.md:213 references/SECURITY_AND_COMPATIBILITY.md:42 runtime/agy-worker.sh:1262 runtime/agy-worker.sh:1262 runtime/agy-worker.sh:237 runtime/agy-worker.sh:663 runtime/agy-worker.sh:673 runtime/agy-worker.sh:685 runtime/agy-worker.sh:897 runtime/agy-worker.sh:1011 runtime/agy-worker.sh:1030 runtime/agy-worker.sh:1200 runtime/agy-worker.sh:1201 runtime/agy-worker.sh:939 runtime/doctor.sh:21 runtime/doctor.sh:24 runtime/doctor.sh:32 runtime/doctor.sh:38 runtime/doctor.sh:86 runtime/doctor.sh:147 runtime/doctor.sh:156 runtime/doctor.sh:157 runtime/doctor.sh:172 runtime/doctor.sh:198 runtime/doctor.sh:199 runtime/doctor.sh:225 runtime/doctor.sh:230 runtime/doctor.sh:231 runtime/doctor.sh:237 runtime/doctor.sh:252 runtime/doctor.sh:253 runtime/doctor.sh:301 runtime/doctor.sh:302 runtime/doctor.sh:304 runtime/doctor.sh:315 runtime/doctor.sh:322 runtime/doctor.sh:468 runtime/doctor.sh:470 runtime/doctor.sh:478 runtime/doctor.sh:479 runtime/doctor.sh:493 runtime/doctor.sh:506 runtime/doctor.sh:527 runtime/doctor.sh:543 runtime/doctor.sh:563 runtime/doctor.sh:579 runtime/doctor.sh:224
β‘ Π‘ΠΎΠ΄Π΅ΡΠΆΠΈΡ ΡΠΊΡΠΈΠΏΡΡ (22)
runtime/agy-worker.sh:1435 runtime/agy-worker.sh:1436 runtime/agy-worker.sh:1448 runtime/agy-worker.sh:1451 runtime/agy-worker.sh:1462 runtime/agy-worker.sh:1493 runtime/scripts/agy_dispatch_containment.py:809-810 runtime/scripts/agy_dispatch_worktree.py:971 runtime/scripts/agy_dispatch_worktree.py:4548 runtime/scripts/agy_dispatch.py:2998 runtime/scripts/agy_dispatch.py:46 runtime/scripts/agy_dispatch.py:3292 runtime/scripts/benchmark.py:88-96 runtime/scripts/benchmark.py:97-100 runtime/scripts/evidence_receipt.py:29-37 runtime/scripts/evidence_receipt.py:38-41 runtime/scripts/evidence_report.py:25-34 runtime/scripts/evidence_report.py:35-38 runtime/scripts/job_lifecycle.py:35-38 runtime/scripts/job_lifecycle.py:39-44 runtime/scripts/job_lifecycle.py:45-54 runtime/scripts/model-recommendation.py:12-18
π ΠΠ΅ΡΠ΅ΠΌΠ΅Π½Π½ΡΠ΅ ΠΎΠΊΡΡΠΆΠ΅Π½ΠΈΡ (15)
runtime/qa-gate.sh:120 runtime/scripts/agy_dispatch_verification.py:151 runtime/scripts/agy_dispatch_worktree.py:1676 runtime/scripts/evidence_receipt.py:1115 runtime/scripts/evidence_receipt.py:1117 runtime/scripts/evidence_receipt.py:1521 runtime/scripts/evidence_receipt.py:955 runtime/scripts/feedback-triage.py:360 runtime/scripts/model_selection.py:98 runtime/scripts/workflow.py:764 runtime/scripts/workflow.py:771 runtime/scripts/workflow.py:803 runtime/scripts/workflow.py:1168 runtime/scripts/workflow.py:1242 runtime/scripts/workflow.py:1667
ΠΡΠ΄ΠΈΡΠΎΡ:: codex ΠΠΎΡΠΌΠΎΡΡΠ΅ΡΡ ΠΈΡΡΠΎΡΠΈΡ Π°ΡΠ΄ΠΈΡΠΎΠ² β
ΠΠΎΠ΄Π΅Π»ΠΈΡΡΡΡ ΠΈ ΡΠΈΡΠΈΡΠΎΠ²Π°ΡΡ ΡΡΠΎΡ ΠΎΡΡΠ΅Ρ
ΠΠ΅Π»ΠΈΡΠ΅ΡΡ Π²Π΅ΡΡΠΈΠΎΠ½Π½ΡΠΌ ΠΎΡΡΠ΅ΡΠΎΠΌ ΠΎΠ± ΠΎΡΠ΅Π½ΠΊΠ΅, Π½Π΅ΠΉΡΡΠ°Π»ΡΠ½ΡΠΌ Π·Π½Π°ΡΠΊΠΎΠΌ, Π²ΡΡΡΠ°ΠΈΠ²Π°Π΅ΠΌΠΎΠΉ ΠΊΠ°ΡΡΠΎΡΠΊΠΎΠΉ ΠΈ ΡΠΈΡΠ°ΡΠ°ΠΌΠΈ. Skillstore ΠΏΡΠ±Π»ΠΈΠΊΡΠ΅Ρ Π΄ΠΎΠΊΠ°Π·Π°ΡΠ΅Π»ΡΡΡΠ²Π°, Π½Π΅ ΡΠ΅ΡΠ°Ρ, Π±Π΅Π·ΠΎΠΏΠ°ΡΠ΅Π½ Π»ΠΈ ΡΡΠΎΡ Skill.
ΠΠΎΠΏΠΈΡΠΎΠ²Π°ΡΡ ΡΡΡΠ»ΠΊΡ Π½Π° ΠΎΡΡΡΡ
https://skillstore.io/skills/cagdasyurekli-agy-worker/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportΠΠ½Π°ΡΠΎΠΊ Markdown
[](https://skillstore.io/skills/cagdasyurekli-agy-worker?utm_source=security_passport_badge)ΠΠ½Π°ΡΠΎΠΊ HTML
<a href="https://skillstore.io/skills/cagdasyurekli-agy-worker?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cagdasyurekli-agy-worker/security.svg" alt="Skillstore security assessment" loading="lazy"></a>ΠΡΡΡΠ°ΠΈΠ²Π°Π΅ΠΌΠ°Ρ ΠΊΠ°ΡΡΠΎΡΠΊΠ°
<iframe src="https://skillstore.io/embed/skills/cagdasyurekli-agy-worker.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>ΠΠΊΠ°Π΄Π΅ΠΌΠΈΡΠ΅ΡΠΊΠΈΠ΅ ΡΡΡΠ»ΠΊΠΈ (APA Β· BibTeX Β· CFF)
Π¦ΠΈΡΠ°ΡΠ° APA
cagdasyurekli. (2026). agy-worker security audit report (audit version 8) [Author version 0.21.0]. Skillstore. https://skillstore.io/skills/cagdasyurekli-agy-worker/audits/8Π¦ΠΈΡΠ°ΡΠ° BibTeX
@techreport{cagdasyurekli-cagdasyurekli-agy-worker-2026,
author = {cagdasyurekli},
title = {agy-worker security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/cagdasyurekli-agy-worker/audits/8},
note = {Author version 0.21.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "agy-worker security audit report (audit version 8)"
version: "0.21.0"
type: report
authors:
- name: "cagdasyurekli"
date-released: "2026-09-20"
url: "https://skillstore.io/skills/cagdasyurekli-agy-worker/audits/8"
identifiers:
- type: other
value: "skillstore:cagdasyurekli-agy-worker:audit:8"
description: "Skillstore immutable audit report identifier"
ΠΡΠ΅Π½ΠΊΠ° Skillstore
ΠΠΎΡΠ΅ΠΌΡ ΡΠ°ΠΊΠ°Ρ ΠΎΡΠ΅Π½ΠΊΠ° ΠΠΎΡΡΠΎΠ²Π΅ΡΠ½ΠΎΡΡΡ Π΄ΠΎΠΊΠ°Π·Π°ΡΠ΅Π»ΡΡΡΠ²: Π‘ΡΠ΅Π΄Π½ΠΈΠΉ 82
ΠΡΡ
ΠΈΡΠ΅ΠΊΡΡΡΠ°
100
Π‘ΠΎΠΏΡΠΎΠ²ΠΎΠΆΠ΄Π°Π΅ΠΌΠΎΡΡΡ
87
ΠΠΎΠ½ΡΠ΅Π½Ρ
67
Π‘ΠΎΠΎΠ±ΡΠ΅ΡΡΠ²ΠΎ
91
Π‘ΠΎΠΎΡΠ²Π΅ΡΡΡΠ²ΠΈΠ΅ ΡΠΏΠ΅ΡΠΈΡΠΈΠΊΠ°ΡΠΈΠΈ
Π§ΡΠΎ Π²Ρ ΠΌΠΎΠΆΠ΅ΡΠ΅ ΠΏΠΎΡΡΡΠΎΠΈΡΡ
Explore an unfamiliar repository
Ask agy to map code paths or investigate a focused question, then review the evidence with Codex.
Implement a bounded change
Delegate a feature, refactor, or test change within an approved scope and verify the resulting diff independently.
Run a broad project workflow
Use project mode for larger audits or repairs while preserving review, checks, and delivery decisions with Codex.
ΠΠΎΠΏΡΠΎΠ±ΡΠΉΡΠ΅ ΡΡΠΈ ΠΏΡΠΎΠΌΠΏΡΡ
Start a repository exploration
Use agy-worker to inspect the repository and explain the code paths related to [topic]. Read only the approved scope and report evidence.
Implement a focused task
Use agy-worker to implement [change] under [paths]. Preserve existing behavior, run relevant checks, and summarize the final diff.
Verify a delegated change
Use agy-worker to review the candidate for [task]. Run independent checks, identify gaps, and repair only within the approved scope.
Run a controlled project workflow
Use agy-worker project mode for [objective]. Require approved provider scope, explicit model and budget, independent verification, and an evidence-based delivery decision.
ΠΡΡΡΠΈΠ΅ ΠΏΡΠ°ΠΊΡΠΈΠΊΠΈ
- Approve the exact provider-readable content, model, budget, and isolation mode before launch.
- Prefer provider scopes and argv verification, then inspect the final diff independently.
- Keep secrets, raw logs, controller state, and unrelated private files outside approved content.
ΠΠ·Π±Π΅Π³Π°ΡΡ
- Do not treat installation as permission to transmit repository content.
- Do not trust worker envelopes, reported tests, or provider claims without independent checks.
- Do not use whole-worktree or shell verification modes without explicit scope and risk approval.
Π§Π°ΡΡΠΎ Π·Π°Π΄Π°Π²Π°Π΅ΠΌΡΠ΅ Π²ΠΎΠΏΡΠΎΡΡ
What does agy-worker delegate?
It delegates repository exploration, implementation, testing, and bounded repair to Google Antigravity CLI.
What remains with Codex?
Codex retains scope decisions, diff review, independent verification, repair decisions, and final acceptance.
Does the skill transmit repository files?
It can transmit approved scoped files or an explicitly approved whole worktree to the external provider.
Is the provider session a sandbox?
No. Default session mode retains normal user filesystem and network authority without native host containment.
Which hosts are supported?
The package supports OpenAI Codex CLI hosts with Bash, Python 3, Git, and agy available.
How should I verify results?
Inspect the actual diff and run driver-owned checks in an isolated verification copy before delivery.
Π‘Π²Π΅Π΄Π΅Π½ΠΈΡ Π΄Π»Ρ ΡΠ°Π·ΡΠ°Π±ΠΎΡΡΠΈΠΊΠΎΠ²
ΠΠ²ΡΠΎΡ
cagdasyurekliΠΠΈΡΠ΅Π½Π·ΠΈΡ
MIT
ΠΠ΅ΡΡΠΈΡ Π°Π²ΡΠΎΡΠ°
v0.21.0
Π Π΅Π²ΠΈΠ·ΠΈΡ Skillstore
r8
Π Π΅ΠΏΠΎΠ·ΠΈΡΠΎΡΠΈΠΉ
https://github.com/cagdasyurekli/codex-agy-worker/tree/3da9a50afaa66492dd77f23f92c6ed4f84be4ada/skills/agy-workerΠ‘ΡΡΠ»ΠΊΠ°
73b58aaf0aa4d29844f1b4c2acf4f530fc1ae7b9
ΠΠΊΡΡΠ°Π»ΡΠ½ΠΎΡΡΡ ΠΏΠΎΠ΄Π΄Π΅ΡΠΆΠΊΠΈ
20.09.2026
ΠΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅
6 Π·Π°Π³ΡΡΠ·ΠΎΠΊ Β· 18 ΠΏΡΠΎΡΠΌΠΎΡΡΠΎΠ²
Π‘ΡΡΡΠΊΡΡΡΠ° ΡΠ°ΠΉΠ»ΠΎΠ²
π agents/
π openai.yaml
π README.md
π references/
π PROJECT_LIFECYCLE_AND_VERIFICATION.md
π SECURITY_AND_COMPATIBILITY.md
π TROUBLESHOOTING.md
π runtime/
π agents/
π bulk-test-writer.md
π diff-reviewer.md
π repo-inventory.md
π agy-worker.sh
π benchmark.sh
π benchmarks/
π v1/
π manifest.json
π portable-source.json
π tasks/
π exact-edit/
π candidate.txt
π envelope.json
π initial.txt
π variants/
π bulk.json
π compat/
π agy-model-effort-matrix.json
π agy-model-effort-matrix.sha256
π agy-models-inventory-binding.json
π agy-models-inventory-binding.sha256
π agy-version-manifest.json
π agy-version-manifest.sha256
π model-effort-matrix.schema.json
π model-intelligence/
π dataset.v1.json
π version-manifest.schema.json
π delegation-policy.sh
π doctor.sh
π evidence-report.sh
π feedback-triage.sh
π ground-truth.sh
π job.sh
π model-evidence-campaign.sh
π model-selection.sh
π qa-gate.sh
π schemas/
π benchmark-plan.schema.json
π benchmark-result.schema.json
π delegation-policy.schema.json
π evidence-receipt.schema.json
π model-evidence-campaign-advisory-preview.schema.json
π model-evidence-campaign-advisory-summary.schema.json
π model-evidence-campaign-aggregate-preview.schema.json
π model-evidence-campaign-aggregate.schema.json
π model-evidence-campaign-evaluation.schema.json
π model-evidence-campaign-plan.schema.json
π model-evidence-campaign-record.schema.json
π model-intelligence-advisory.schema.json
π model-intelligence-evidence.schema.json
π model-recommendation.schema.json
π model-selection.schema.json
π swebench-workflow-study-advisory.schema.json
π swebench-workflow-study-plan.schema.json
π swebench-workflow-study-report.schema.json
π worker-result.provider.schema.json
π worker-result.schema.json
π workflow-state.schema.json
π scripts/
π agy_dispatch_containment.py
π agy_dispatch_verification.py
π agy_dispatch.py
π benchmark.py
π candidate_state.py
π compatibility.py
π delegation_policy.py
π doctor-metadata.py
π evidence_receipt.py
π evidence_report.py
π feedback-triage.py
π job_lifecycle.py
π model_evidence_campaign.py
π model_selection.py
π swebench_workflow_study.py
π validate-envelope.py
π version_manifest_engine.py
π workflow.py
π swebench-workflow-study.sh
π verify-job.sh
π workflow.sh
π scripts/
π resolve-pipeline.sh
π SKILL.md