An ADK 2.0 shopping assistant agent built as a hands-on demonstration of "shift-left" security in AI-agent development using Google's Antigravity IDE, automated STRIDE threat modeling, custom static-analysis rules, and a fully autonomous pre-commit self-correction loop.
Built as part of Google's 5-Day AI Agents: Intensive Vibe Coding Course (Secure Agentic Coding lab).
Rather than treating security as a late-stage code review gate, this project pushes security checks to the point of code inception, enforced automatically at every layer.
An ADK 2.0 LlmAgent (root_agent) acting as a retail shopping assistant with two tools:
- redeem_discount_code: redeems single-use discount codes against an in-memory store, enforcing single-use redemption and requiring a registered user ID.
- award_loyalty_points: awards loyalty points after a purchase, with strict Pydantic validation.
A CONTEXT.md file defines project-wide secure coding standards, including a Pre-Commit Remediation Loop rule and a TDD Planning Gate rule requiring every implementation plan to include a Security Boundaries and Assertions section before code is written.
A custom Antigravity Skill analyzes the codebase against all six STRIDE categories and produces threat_model.md. Findings included missing identity verification, race conditions in the in-memory store, no audit logging, no rate limiting, and no API authentication.
A Git pre-commit hook with a custom Semgrep rule catches hardcoded Google API keys. An Antigravity agent hook intercepts run_command calls before execution, blocking destructive patterns like rm -rf /.
The agent's first draft intentionally included a hardcoded mock API key to prove the remediation loop works end to end. When the commit failed due to the Semgrep scan, Antigravity autonomously read the error, refactored the code to load the key from an environment variable instead, reran all tests, and successfully committed on the second attempt, guided only by the standing rule in CONTEXT.md.
uv sync export GEMINI_API_KEY="your_key_here" agents-cli playground
Google ADK 2.0, Gemini, Antigravity IDE, Agents CLI, Semgrep, pre-commit, pytest, STRIDE threat modeling methodology