70High
The skill facilitates unauthorized offensive security operations and introduces critical supply chain risks by allowing automated, high-privilege code modification based on potentially malicious, user-controlled inputs.
HygienePackaging & Manifest2 findings
Skill Info
Namesickn33/antigravity-awesome-skills/security-scanning-security-hardening
Registrygithub
Versionbe20b372ace9
PURLpkg:github/sickn33/antigravity-awesome-skills@be20b372ace9?skill=security-scanning-security-hardening
Stars41,170
Installs499
Source
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
Assessments (3)
AI Agent Traps ↗Description Mismatchhighdescription mismatchAML.T0011.000LLM06:2025LLM09:2025
The skill includes instructions to execute offensive security tools (Metasploit, Burp Suite) and perform penetration testing, which exceeds the scope of 'security hardening' and 'defense-in-depth' controls.
85% confidence
Phase 4, Step 11: 'Execute comprehensive penetration testing... Use Burp Suite, Metasploit, and custom exploits.'
Unrestricted automated remediationhighcommand executionAML.T0050AML.T0053AML.T0072LLM05:2025LLM06:2025
The skill mandates automated code modification ('Patched code with vulnerability fixes') based on the output of automated scanners. This creates a high risk of 'poisoned' remediation where an attacker influences the scanner output to force the agent to inject malicious code into the codebase.
80% confidence
Coordinate immediate remediation of critical vulnerabilities (CVSS 7+) in: $ARGUMENTS. Fix SQL injections... Apply security patches for CVEs.
Exploitation or pentest tool — offensive security tool invocationhighlateral movementAML.T0053AML.T0049LLM06:2025
Exploitation or pentest tool — offensive security tool invocation
100% confidenceline 107
Metasploit
Sub-agent prompt injection riskmediumsub agent spawningAML.T0053AML.T0051.001LLM06:2025
The skill instructs the agent to spawn sub-agents with broad, high-privilege instructions (e.g., 'Perform comprehensive security assessment', 'Execute... custom exploits') using user-provided arguments. This allows an attacker to inject malicious commands into the sub-agent's execution context via the $ARGUMENTS variable.
90% confidence
Use Task tool with subagent_type="security-auditor" - Prompt: "Perform comprehensive security assessment on: $ARGUMENTS."
Missing usage exampleslowpolicy violation
Skill body contains no code blocks or usage examples, making it harder for users to evaluate.
100% confidence
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/sickn33/antigravity-awesome-skills/security-scanning-security-hardening)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/sickn33/antigravity-awesome-skills/security-scanning-security-hardening"><img src="https://mondoo.com/ai-agent-security/api/badge/github/sickn33/antigravity-awesome-skills/security-scanning-security-hardening.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/sickn33/antigravity-awesome-skills/security-scanning-security-hardening.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow