Google Antigravity 模型全自动运维方案。提供多账号自动轮换、优先级调度、会话热更新以及赛博朋克风仪表盘。使用场景包括：(1) 自动化管理多个 Antigravity 账号，(2) 监控配额并自动切换，(3) 在不重启会话的情况下更新模型。
Security Analysis
medium confidenceThe skill's code and instructions are coherent with its stated purpose (rotating Antigravity/Google model accounts and hot-swapping sessions), but it accesses and updates sensitive local auth data and contains hard-coded OAuth credentials — review and caution are advised before use.
Name/description match the implementation: the code reads OpenClaw auth profiles and model status, queries a quota API, refreshes OAuth tokens, and triggers rotations via the openclaw gateway. The files and CLI actions (setup/dashboard/rotate) are consistent with multi-account rotation and hot-update functionality.
SKILL.md instructs running setup, the dashboard, and a cron-driven rotate action; the implementation follows that. However, the runtime will read and write OpenClaw files (auth-profiles.json, model-status.json, rotation logs) and invoke system commands (openclaw gateway status) and external HTTP endpoints via curl. Those behaviors are necessary for the stated task but are high-sensitivity operations and should be called out to the user.
No install spec or external downloads; this is a Node script that runs with existing node/openclaw binaries and uses standard child_process/curl calls. No remote code fetch or archive extraction is performed by the skill itself.
The skill does not require additional environment variables but it reads and updates the OpenClaw auth-profiles file (which contains access and refresh tokens) and writes updated tokens back. This is functionally necessary for token refresh/rotation, but it is sensitive: the skill has direct access to authentication material that can control accounts. Additionally, the repository includes a hard-coded clientId/clientSecret and default project ID — plausible for a shared 'Antigravity' client but potentially inappropriate if you expect only your own OAuth credentials to be used.
always:false (no forced always-on). The skill writes to OpenClaw workspace files (status DB, rotation logs) and updates auth-profiles, which will affect agent authentication state. Modifying these shared OpenClaw files is expected for an account rotator, but it means the skill can change credentials and the system's active session — review and backup your auth files before installing.
Guidance
This skill appears to implement the advertised Antigravity account rotation features, but it performs sensitive operations: it reads and updates your OpenClaw auth-profiles (refresh/access tokens), calls external endpoints (a quota API and Google OAuth token endpoint) and executes shell commands (openclaw, curl). Before installing or running: 1) Back up ~/.openclaw/agents/.../auth-profiles.json and any other OpenClaw workspace files it will modify. 2) Inspect the remainder of scripts/rotator.js (performRotation and warmup) to confirm there is no unexpected network exfiltration or unsafe operations — a truncated portion of rotator.js in the package makes a full audit necessary. 3) Consider replacing the bundled clientId/clientSecret with your own OAuth credentials if you want control over which project is used. 4) Run it in an isolated environment or test account first so token updates can't affect production accounts. 5) Note it uses execSync + curl; ensure PATH and config.json are correct to avoid accidental command injection through manipulated config. If you want, I can (a) scan the remaining truncated code for suspicious calls, or (b) produce a short checklist of the exact lines to inspect for exfil/privilege escalation.
Latest Release
v1.1.1
Fix example config path in index.js
More by @ChocomintX
Published by @ChocomintX on ClawHub
