install-work-kit

Warn

Audited by Socket on Sep 20, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the stated purpose matches plugin/skill installation, but the actual footprint relies on executing shell scripts from a personal GitHub repo and installing external skills transitively. Data flow is broadly consistent with the purpose, yet install trust is weak and disproportionate to a simple setup guide because it uses mutable, unverified repo scripts and expands into cloud sync.

Confidence: 90%Severity: 74%
Audit Metadata
Analyzed At
Sep 20, 2026, 06:00 AM
Package URL
pkg:socket/skills-sh/ses2905%2Fai-toolkit%2Finstall-work-kit%2F@382adff154f002755e8521334dbee92e7e3d06924450cd5a6fb479e33c227c0f