gemini-antigravity-cli

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The majority of the listed endpoints are legitimate (corporate proxy, Google Generative Language API, npm registry, and ara.so), but the GitHub Releases URL (testerlingcodo/.../antigravity-cli.zip) is high-risk because it supplies a prebuilt ZIP/executable from an unknown GitHub user — a common malware distribution pattern, so treat the download as suspicious unless you can verify the author or build from source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill’s MCP server configuration runs npx to fetch and execute remote MCP server packages at runtime (e.g. via https://registry.npmjs.org/@modelcontextprotocol/server-filesystem and https://registry.npmjs.org/@modelcontextprotocol/server-github), which downloads and runs remote code that can provide context to and control the agent.