se-dev-mod

Warn

Audited by Socket on May 9, 2026

1 alert found:

Security
SecurityMEDIUM
Prepare.bat

No explicit malicious payload, exfiltration, or credential theft is visible in this batch fragment; however, it contains significant supply-chain and remote-execution risk. The script executes a remotely fetched PowerShell installer for `uv` using `ExecutionPolicy ByPass` and `iex` without integrity pinning, and it downloads an external executable without checksum/signature verification. It also redirects key data directories via junctions into user-writable locations, increasing the impact of any tampered local mod content when indexing scripts run.

Confidence: 74%Severity: 77%
Audit Metadata
Analyzed At
May 9, 2026, 09:14 PM
Package URL
pkg:socket/skills-sh/viktor-ferenczi%2Fse-dev-skills%2Fse-dev-mod%2F@57e8801fe63204f7d80a8eb10ab8a29dffa454dc