antigravity-lazy-packs

Warn

Audited by Socket on Sep 7, 2026

2 alerts found:

Securityx2
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the skill is an installation wrapper whose main purpose is to add and execute other third-party skills from a personal GitHub repo. The install path uses a legitimate CLI, but the transitive trust model, unpinned remote content, and fallback execution of remote SKILL.md instructions make the footprint broader and riskier than a normal setup helper.

Confidence: 91%Severity: 74%
SecurityMEDIUM
skills/00-install-all/SKILL.md

SUSPICIOUS. The skill is a bulk installer for other skills, creating a transitive trust chain without exposing the actual permissions, installers, credentials, or network endpoints of those subskills in this file. Evidence suggests some downstream tooling is official, but at least one referenced integration has incomplete provenance, so the bundle is not internally transparent enough to treat as benign.

Confidence: 84%Severity: 72%
Audit Metadata
Analyzed At
Sep 7, 2026, 01:41 PM
Package URL
pkg:socket/skills-sh/mathruffian-dot%2Fantigravity-lazy-pack%2Fantigravity-lazy-packs%2F@f3e8592f411533d0777625b14f9e041c72acc9b3
Security Audit — socket — antigravity-lazy-packs