Is referodesign/refero_skill safe?
Yes. referodesign/refero_skill is safe to install. Oathe's behavioral security audit gave the refero_skill skill by referodesign a trust score of 85/100 with 3 findings, none critical or high.
https://github.com/referodesign/refero_skill
Is referodesign/refero_skill safe to install?
This is a legitimate design methodology skill providing comprehensive documentation and workflows for research-first design using Refero MCP tools. While sensitive files were accessed during installation, no actual data exfiltration occurred and the skill contains only documentation with no executable code.
What security issues were found in referodesign/refero_skill?
Category Scores
Findings (3)
MEDIUM Sensitive File Access During Installation -25 ▶
The skill installation process accessed multiple sensitive credential files including .env, SSH keys, AWS credentials, Docker config, and GCloud credentials. However, filesystem monitoring confirmed these files were not modified or their contents exfiltrated.
LOW Complex Instructional Content -5 ▶
The skill contains extensive design methodology instructions that could potentially overwhelm or confuse agent behavior, though no actual prompt injection attempts were detected.
LOW File System Monitoring Anomaly -10 ▶
Pattern of accessing credential files is unusual for a documentation-only skill, though this may be related to audit environment monitoring rather than malicious behavior.
Should I install referodesign/refero_skill?
Oathe's verdict for referodesign/refero_skill is SAFE with a trust score of 85/100. Recommendation: Install with caution.