antigravity-marketing-lab

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The set includes a high-risk pattern: the README instructs piping a remote install script (https://antigravity.google/cli/install.sh) directly into bash (remote .sh execution), and the GitHub repo is from an individual account of uncertain reputation — while ara.so and the community.dev link look benign, the direct curl|bash installer from a non-obvious project origin makes this a suspicious download source without further verification.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's installation instructs running a remote installer via "curl -fsSL https://antigravity.google/cli/install.sh | bash", which fetches and executes remote code (required to obtain the agy CLI), so this URL is a runtime dependency that executes remote code.