configuring-ghostty-vibe-stack
Audited by Socket on Feb 27, 2026
1 alert found:
MalwareThis is a setup instruction document for a Ghostty/Fish/Neovim development environment on macOS. Its actions are plausible and consistent with the stated purpose, but it contains multiple supply-chain and local-execution patterns that raise moderate security concerns: unpinned download-and-execute steps (Homebrew installer and Fisher installer), compilation/execution of a temporary Swift helper, automatic import of shell history (potentially exposing secrets), and modifications to /etc/shells. These patterns are common in dotfiles/installer guides but materially increase attack surface and can be abused if upstream sources are compromised. Recommend users: review remote scripts before running (do not pipe to shell without inspection), pin or verify checksums where possible, back up existing configs before overwriting, inspect shell history for secrets before running atuin import, and avoid running installers with sudo unless necessary.