google-antigravity-sdk

SUSPICIOUS/VULNERABLE rather than confirmed malware. The skill’s stated purpose broadly matches its capabilities, but it depends on an effectively unverifiable compiled runtime and forwards a live API key into that runtime, which triggers mandatory high risk. Transitive skill/plugin installation paths further increase trust exposure.