skill-creator
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONPERSISTENCEEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script
scripts/install_tools.shdownloads a shell script from an external URL (https://raw.githubusercontent.com/antigravity-org/tools/main/install.sh) and pipes it directly into the bash interpreter. This is a critical security risk as the remote content is executed without verification. - [PERSISTENCE]: The installation script automatically appends an alias to the user's
~/.bashrcfile. Modifying shell profile scripts is a persistence mechanism used to maintain changes across different terminal sessions. - [EXTERNAL_DOWNLOADS]: The skill attempts to install a global Node.js package
antigravity-clifrom an unverified vendor.
Recommendations
- AI detected serious security threats
Audit Metadata