Is Architect-SIS/sis-skill safe?
Use with caution. Architect-SIS/sis-skill is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the sis-skill skill by Architect-SIS a trust score of 53/100 with 5 findings (1 critical, 2 high).
https://github.com/Architect-SIS/sis-skill
Is Architect-SIS/sis-skill safe to install?
This skill presents significant security concerns due to systematic credential file access during installation, despite presenting itself as a computational framework for equilibrium reasoning. The substantial executable Python codebase combined with credential scanning behavior indicates potential data exfiltration capabilities.
What security issues were found in Architect-SIS/sis-skill?
Category Scores
Findings (5)
CRITICAL Multiple credential files accessed -80 ▶
The skill accessed sensitive credential files including .env, SSH private keys, AWS credentials, npm configuration, Docker configuration, and Google Cloud credentials during installation
HIGH Substantial executable Python codebase -45 ▶
The skill contains a complex, multi-module Python codebase with VM functionality, symbol execution, and persistence layers that could execute arbitrary operations
HIGH Behavior inconsistent with documentation -75 ▶
While documentation describes an equilibrium computational framework, the actual behavior includes systematic credential file scanning which is not mentioned or justified
MEDIUM Credential scanning during installation -25 ▶
The installation process triggered access to multiple credential files, suggesting the skill may perform unauthorized data collection during setup
LOW Complex technical terminology -10 ▶
Uses sophisticated technical language about equilibrium systems and computational substrates that could obscure malicious intent from casual review
Should I install Architect-SIS/sis-skill?
Oathe's verdict for Architect-SIS/sis-skill is CAUTION with a trust score of 53/100. Recommendation: Review before install.