You can define any executable in the $BROWSER environment variable which will be executed whenever antigravity is imported.

You could execute a 'curl` which directly pipes into 'bash -c'.

This is flat wrong. You can cause it to run an arbitrary binary by setting the BROWSER environment variable, as they demonstrate in the article. They chained it with perl environment variable vulnerability listed earlier to achieve execution.