install-work-kit
Warn
Audited by Socket on Sep 20, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS: the stated purpose matches plugin/skill installation, but the actual footprint relies on executing shell scripts from a personal GitHub repo and installing external skills transitively. Data flow is broadly consistent with the purpose, yet install trust is weak and disproportionate to a simple setup guide because it uses mutable, unverified repo scripts and expands into cloud sync.
Confidence: 90%Severity: 74%
Audit Metadata