Security Audit
gemini-api-dev
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
gemini-api-dev received a trust score of 81/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 3 medium, and 0 low severity. Key findings include Unpinned Python dependency, Unpinned JavaScript/TypeScript dependency, Unpinned Go dependency.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned Python dependency The skill instructs users to install the 'google-genai' Python package without specifying a version. This can lead to supply chain vulnerabilities if a malicious version of the package is published or if future versions introduce breaking changes or security flaws. It's best practice to pin dependencies to specific versions. Specify a version for the 'google-genai' package, e.g., `pip install google-genai==X.Y.Z`, or use a dependency management tool with lock files. | LLM | SKILL.md:30 | |
| MEDIUM | Unpinned JavaScript/TypeScript dependency The skill instructs users to install the '@google/genai' JavaScript/TypeScript package without specifying a version. This can lead to supply chain vulnerabilities if a malicious version of the package is published or if future versions introduce breaking changes or security flaws. It's best practice to pin dependencies to specific versions. Specify a version for the '@google/genai' package, e.g., `npm install @google/genai@X.Y.Z`, or use a dependency management tool with lock files. | LLM | SKILL.md:31 | |
| MEDIUM | Unpinned Go dependency The skill instructs users to install the 'google.golang.org/genai' Go package without specifying a version. This can lead to supply chain vulnerabilities if a malicious version of the package is published or if future versions introduce breaking changes or security flaws. It's best practice to pin dependencies to specific versions. Specify a version for the 'google.golang.org/genai' package, e.g., `go get google.golang.org/genai@vX.Y.Z`, or use a dependency management tool with lock files. | LLM | SKILL.md:32 |
Scan History
Embed Code
[](https://skillshield.io/report/3161f4cc2dc1cd42)
Powered by SkillShield