se-dev-torch

Warn

Audited by Socket on Aug 20, 2026

1 alert found:

Anomaly
AnomalyLOW
Prepare.bat

This script is primarily a build/bootstrap orchestrator, but it contains multiple supply-chain/execution risks: it executes a remote installer script via PowerShell `iex` (with ExecutionPolicy bypass) to install `uv`, downloads an external executable (`busybox64u.exe`) without integrity verification, and clones/pulls a remote GitHub repository that is then used to execute a Python script (`index_torch.py`). No clear data exfiltration, credential theft, persistence, or backdoor behavior is visible in this fragment alone, but the remote code execution surface is significant. Review the referenced scripts (`index_torch.py`, `GraphifyPrepare.bat`) and add/verify hashes/signatures for downloaded content if used in sensitive environments.

Confidence: 72%Severity: 60%
Audit Metadata
Analyzed At
Aug 20, 2026, 12:34 PM
Package URL
pkg:socket/skills-sh/cometworks%2Fskills%2Fse-dev-torch%2F@dbd225545f1ad6e11021f132d0dfa17be4a4887a94e805ec4b4f9c3b8d975a7c
Security Audit — socket — se-dev-torch