se-dev-script

Warn

Audited by Socket on Apr 28, 2026

1 alert found:

Anomaly
AnomalyLOW
Prepare.bat

No direct evidence of credential theft, exfiltration, or persistence is present in this batch fragment. However, it contains multiple supply-chain-critical trust failures: it downloads and executes a remote installer script via PowerShell (ExecutionPolicy ByPass + iex) and downloads an executable without integrity verification. It also creates junctions into game/workshop/local script paths based on a potentially user-controlled SE_GAME_ROOT. The main security exposure therefore stems from remote code/binary retrieval and unpinned trust in external content plus unverified downstream effects in index_scripts.py.

Confidence: 62%Severity: 64%
Audit Metadata
Analyzed At
Apr 28, 2026, 10:25 PM
Package URL
pkg:socket/skills-sh/viktor-ferenczi%2Fse-dev-skills%2Fse-dev-script%2F@6ecae908061e90f8073d31f6f307024af52d1b1d