qveris-official

Warn

Audited by Socket on Sep 22, 2026

1 alert found:

Security
SecurityMEDIUM
instruct.md

This is an installation procedure with material supply-chain risk, not direct evidence of malware. It performs broad destructive cleanup, downloads executable code from a remote domain without integrity verification, executes that code, and inconsistently persists the API key in ~/.bashrc. The misspelled verification path can also cause an incomplete or misleading installation. Do not execute without reviewing and pinning the downloaded files, narrowing deletion to an explicitly approved directory, and keeping the API key session-scoped.

Confidence: 96%Severity: 78%
Audit Metadata
Analyzed At
Sep 22, 2026, 03:37 AM
Package URL
pkg:socket/skills-sh/qverisai%2Fopen-qveris-skills%2Fqveris-official%2F@b30b1421a4e57aa0ef29a58e6f417ddd7af32b38e0aed668538573e1d0b6f2ed