se-dev-game-code

Warn

Audited by Socket on Aug 22, 2026

1 alert found:

Anomaly
AnomalyLOW
common-posix.sh

No direct malicious payload is evident in this Bash fragment (no exfiltration, credential harvesting, reverse shells, or persistence mechanisms). The main security concern is supply-chain risk: it executes a remotely fetched uv installer via curl/wget | sh, and it installs ilspycmd at runtime via dotnet tool install. Additionally, it modifies PATH to include user-writable directories, which can enable execution of trojaned binaries if the environment is compromised. Treat as a medium supply-chain risk bootstrap script and add verification/pinning/hardening where possible.

Confidence: 62%Severity: 52%
Audit Metadata
Analyzed At
Aug 22, 2026, 01:38 AM
Package URL
pkg:socket/skills-sh/cometworks%2Fskills%2Fse-dev-game-code%2F@bc07e84e0ad81cf082e27d91c9013c8301371afefb453667b40fe4c6b88a5e62
Security Audit — socket — se-dev-game-code