Is lhassa8/veridano-skill safe?
Yes. lhassa8/veridano-skill is safe to install. Oathe's behavioral security audit gave the veridano-skill skill by lhassa8 a trust score of 87/100 with 4 findings (1 high).
https://github.com/lhassa8/veridano-skill
Is lhassa8/veridano-skill safe to install?
This skill appears to be a legitimate cybersecurity intelligence tool that provides access to government security data from CISA, FBI, and NIST. While it accessed sensitive files during installation and depends on an external API endpoint, no actual data exfiltration was detected and the functionality aligns with its stated purpose.
What security issues were found in lhassa8/veridano-skill?
Category Scores
Findings (4)
HIGH External API endpoint dependency -15 ▶
The skill makes API calls to an external AWS endpoint (7lqg8v66p1.execute-api.us-east-1.amazonaws.com) which could potentially be used as a data exfiltration or command-and-control channel if compromised.
MEDIUM Accessed sensitive system files -10 ▶
During installation, the skill accessed multiple sensitive files including SSH keys, AWS credentials, and environment files. While no exfiltration was detected, this behavior indicates broader system access than expected.
LOW Contains executable Python script -15 ▶
The skill includes a Python script (veridano_client.py) that could execute code. However, the script appears legitimate and is a standard HTTP client for the Veridano API.
LOW Third-party service dependency risk -20 ▶
The skill's functionality depends entirely on an external third-party service. If this service were compromised, it could potentially be used for malicious purposes including data collection or misinformation.
Should I install lhassa8/veridano-skill?
Oathe's verdict for lhassa8/veridano-skill is SAFE with a trust score of 87/100. Recommendation: Install with caution.