antigravity-lazy-packs
Audited by Socket on Sep 7, 2026
2 alerts found:
Securityx2SUSPICIOUS: the skill is an installation wrapper whose main purpose is to add and execute other third-party skills from a personal GitHub repo. The install path uses a legitimate CLI, but the transitive trust model, unpinned remote content, and fallback execution of remote SKILL.md instructions make the footprint broader and riskier than a normal setup helper.
SUSPICIOUS. The skill is a bulk installer for other skills, creating a transitive trust chain without exposing the actual permissions, installers, credentials, or network endpoints of those subskills in this file. Evidence suggests some downstream tooling is official, but at least one referenced integration has incomplete provenance, so the bundle is not internally transparent enough to treat as benign.