se-dev-script

Warn

Audited by Socket on Feb 26, 2026

1 alert found:

Anomaly
AnomalyLOW
Prepare.bat

The script's purpose is environment setup for a Steam/Space Engineers mod project. It is not obviously a stealthy backdoor or explicitly malicious in its immediate logic, but it performs high-risk actions: executes a remote PowerShell install script (irm | iex) and downloads an executable without integrity checks; it also creates junctions into user data. These behaviors present a real supply-chain risk because a compromised remote host (astral.sh or frippery.org) or man-in-the-middle could execute arbitrary code on the developer's machine. Recommendation: do not run this script without auditing the remote install.ps1, replacing remote fetches with pinned, verified artifacts (checksums/signatures), and ensuring any downloaded executables are from trusted sources. Consider removing or sandboxing use of 'irm | iex' and verifying URLs and cryptographic integrity before execution.

Confidence: 90%Severity: 60%
Audit Metadata
Analyzed At
Feb 26, 2026, 07:12 PM
Package URL
pkg:socket/skills-sh/viktor-ferenczi%2Fse-dev-skills%2Fse-dev-script%2F@b5ad8258872bf943d835d3aab09be6220b531537