Trust Assessment
antigravity-quota received a trust score of 81/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 3 medium, and 0 low severity. Key findings include Unsafe deserialization / dynamic eval, Hardcoded OAuth Client Secret.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unsafe deserialization / dynamic eval Base64 decode of large encoded payload (Node.js) Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/mukhtharcm/antigravity-quota/check-quota.js:35 | |
| MEDIUM | Unsafe deserialization / dynamic eval Base64 decode of large encoded payload (Node.js) Remove obfuscated code execution patterns. Legitimate code does not need base64-encoded payloads executed via eval, encrypted-then-executed blobs, or dynamic attribute resolution to call system functions. | Manifest | skills/mukhtharcm/antigravity-quota/check-quota.js:36 | |
| MEDIUM | Hardcoded OAuth Client Secret The OAuth CLIENT_SECRET is hardcoded and base64 encoded directly within the `check-quota.js` script. While the skill describes this as a 'public client', the script explicitly transmits this `client_secret` in the OAuth token refresh request. Hardcoding and transmitting a client secret, even for a public client, is generally considered a security anti-pattern. If this secret were to be compromised, it could potentially be used to impersonate the client application in certain contexts, leading to unauthorized access or other security issues. It also creates a maintenance burden if the secret ever needs to be rotated. If this client secret is truly not required by the OAuth provider for public clients, remove its transmission from the request. If it is required, consider alternative, more secure methods for managing this secret, such as environment variables or a secure configuration store, rather than embedding it directly in the source code. Ensure the client secret is rotated regularly. | LLM | check-quota.js:26 |
Scan History
Embed Code
[](https://skillshield.io/report/68da23b07fb7abdf)
Powered by SkillShield