Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

Antigravity Ai Skills

Transform Claude Code, Antigravity IDE, Cursor, and AI Agents into an elite, 10-Year Experienced Senior Full-Stack Engineer and Local SEO Director.

Compatibility: Not stated.

Grade D

Two or more Medium findings, or a High finding. Only try it in a sandbox.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit c1da5dc7cf2c, unchanged since the check below.

INSTALL_REMOTE_SCRIPT SECRETS_PATH_CREDENTIAL

Why this grade

  • INSTALL_REMOTE_SCRIPT High

    Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).

    skills/kubernetes-specialist/references/multi-cluster.md, line 151 curl -Ls https://get.submariner.io | bash

  • SECRETS_PATH_CREDENTIAL Medium

    Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).

    skills/atlassian-mcp/references/authentication-patterns.md, line 463 credentials.json

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Concern

    can delete files.

    PERMISSION_DELETE_FILES

    skills/academic-thesis-typesetter/scripts/typeset_thesis.py, line 167

    res = subprocess.run(["osascript", "-e", ascript], capture_output=True, text=True)

    skills/chaos-engineer/references/infrastructure-chaos.md, line 242

    subprocess.run([

    skills/chaos-engineer/references/infrastructure-chaos.md, line 255

    subprocess.run([

    Show more

    skills/fine-tuning-expert/references/deployment-optimization.md, line 257

    subprocess.run([

    skills/fine-tuning-expert/references/deployment-optimization.md, line 266

    subprocess.run([

    skills/fine-tuning-expert/references/deployment-optimization.md, line 274

    os.remove(f"{output_path}/model-f16.gguf")

    skills/legacy-modernizer/references/system-assessment.md, line 104

    result = subprocess.run(

    skills/rag-architect/references/embedding-models.md, line 223

    "def install_package(name):\n subprocess.run(['pip', 'install', name])",

    skills/sre-engineer/SKILL.md, line 167

    subprocess.run(

  • Install and update

    Serious

    install fetches a script from the network.

    INSTALL_REMOTE_SCRIPT

    skills/kubernetes-specialist/references/multi-cluster.md, line 151

    curl -Ls https://get.submariner.io | bash

    skills/kubernetes-specialist/references/service-mesh.md, line 9

    curl -L https://istio.io/downloadIstio | sh -

    skills/kubernetes-specialist/references/service-mesh.md, line 322

    curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh

  • Network

    Concern

    can reach a host that is not written as a fixed address. can reach auth.atlassian.com. The description does not name that host. can reach your-site.atlassian.net. The description does not name that host. can reach jira.internal.company.com. The description does not name that host. can reach api.example.com. The description does not name that host. can reach your-company.atlassian.net. The description does not name that host. can reach prometheus. The description does not name that host. can reac

    NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

    skills/angular-architect/references/rxjs.md, line 277

    this.http.get('/api/data').pipe(

    skills/atlassian-mcp/references/authentication-patterns.md, line 47

    const response = await fetch('https://auth.atlassian.com/oauth/token', {

    skills/atlassian-mcp/references/authentication-patterns.md, line 81

    const response = await fetch('https://auth.atlassian.com/oauth/token', {

    Show more

    skills/atlassian-mcp/references/authentication-patterns.md, line 102

    const response = await fetch(

    skills/atlassian-mcp/references/authentication-patterns.md, line 176

    const response = await fetch('https://your-site.atlassian.net/rest/api/3/myself', {

    skills/atlassian-mcp/references/authentication-patterns.md, line 219

    const response = await fetch(`${VAULT_ADDR}/v1/${path}`, {

    skills/atlassian-mcp/references/authentication-patterns.md, line 246

    const response = await fetch('https://jira.internal.company.com/rest/api/2/myself', {

    skills/atlassian-mcp/references/authentication-patterns.md, line 491

    const meResponse = await fetch(

    skills/devops-engineer/SKILL.md, line 126

    HEALTHCHECK --interval=30s --timeout=5s CMD curl -f http://localhost:8080/health || exit 1

    skills/devops-engineer/references/docker-patterns.md, line 24

    CMD wget -qO- http://localhost:3000/health || exit 1

    skills/devops-engineer/references/docker-patterns.md, line 47

    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"

    skills/graphql-architect/references/migration-from-rest.md, line 880

    const response = await fetch(`http://localhost:3000/api/users/${id}`);

    skills/kubernetes-specialist/references/multi-cluster.md, line 11

    curl -L https://github.com/kubernetes-sigs/cluster-api/releases/download/v1.6.0/clusterctl-linux-amd64 -o clusterctl

    skills/monitoring-expert/references/application-profiling.md, line 176

    curl http://localhost:6060/debug/pprof/profile?seconds=30 > cpu.prof

    skills/monitoring-expert/references/application-profiling.md, line 180

    curl http://localhost:6060/debug/pprof/heap > heap.prof

    skills/monitoring-expert/references/application-profiling.md, line 184

    curl http://localhost:6060/debug/pprof/goroutine > goroutine.prof

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

    skills/atlassian-mcp/references/authentication-patterns.md, line 199

    const token = process.env.ATLASSIAN_API_TOKEN;

    skills/atlassian-mcp/references/authentication-patterns.md, line 442

    # .env.example (commit this)

    skills/atlassian-mcp/references/authentication-patterns.md, line 463

    credentials.json

    Show more

    skills/atlassian-mcp/references/authentication-patterns.md, line 460

    .env

    skills/atlassian-mcp/references/authentication-patterns.md, line 461

    .env.local

    skills/atlassian-mcp/references/authentication-patterns.md, line 462

    .env.*.local

    skills/cli-developer/references/design-patterns.md, line 145

    ├── credentials.json # Sensitive data (600 perms)

    skills/devops-engineer/references/docker-patterns.md, line 106

    .env*

    skills/django-storages-s3/references/configuration.md, line 24

    AWS_ACCESS_KEY_ID = os.environ.get("AWS_ACCESS_KEY_ID")

    skills/django-storages-s3/references/configuration.md, line 25

    AWS_SECRET_ACCESS_KEY = os.environ.get("AWS_SECRET_ACCESS_KEY")

    skills/django-storages-s3/references/configuration.md, line 97

    AWS_CLOUDFRONT_KEY_ID = os.environ.get("AWS_CLOUDFRONT_KEY_ID")

    skills/django-storages-s3/references/configuration.md, line 98

    AWS_CLOUDFRONT_KEY = os.environ.get("AWS_CLOUDFRONT_KEY") # PEM private key string

    skills/fastapi-expert/references/pydantic-v2.md, line 111

    env_file=".env",

    skills/graphql-architect/references/migration-from-rest.md, line 708

    const payload = jwt.verify(token, process.env.JWT_SECRET);

    skills/graphql-architect/references/migration-from-rest.md, line 742

    const payload = jwt.verify(token, process.env.JWT_SECRET);

    skills/graphql-architect/references/security.md, line 232

    const decoded = jwt.verify(token, process.env.JWT_SECRET!);

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Note

    the file cap was reached before every file was read.

    OBFUSCATION_FILE_CAP_REACHED

    skills/postgres-pro/references/maintenance.md, line 1

    # Database Maintenance

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit c1da5dc7cf2c. can delete files. install fetches a script from the network. can reach a host that is not written as a fixed address. can reach auth.atlassian.com. The description does not name that host. can reach your-site.atlassian.net. The description does not name that host. can reach jira.internal.company.com. The description does not name that host. can reach api.example.com. The description does not name that host. can reach your-company.atlassian.net. The description does not name that host. can reach prometheus. The description does not name that host. can reac reads a credential or environment file. the file cap was reached before every file was

Date and source

Date checked:

View source

github.com

Commit graded: c1da5dc7cf2cfef63aec47f73b1766d9ee6f6238

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen