gravit-designer-unlocker-analysis

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The GitHub repository (SHOYEBUL1/gravit-design-toolkit-unlocker.git) and its GitHub Pages download link (shoyebul1.github.io) are high-risk—they exhibit piracy/crack wording, external hosting for downloads, and originate from an unknown account—while the other listed domains (figma.com, ara.so, designer.io, inkscape.org, and GitHub’s report-abuse page) are legitimate and low risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repository presents multiple deliberate malicious indicators — license‑bypass social engineering, external redirect download with no visible source, likely payload hosting/obfuscation, and star-velocity manipulation — consistent with intentional malware/backdoor distribution and data‑exfiltration risk.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill includes explicit sudo-level commands (bringing down network interfaces, installing packages, running system-wide scans) and instructions that modify system state, so it pushes the agent to perform privileged operations and should be flagged.