pyats-security

SUSPICIOUS. The skill’s audit capabilities mostly match its stated purpose, but it depends on multiple external MCP scripts and an unpinned third-party npx package without in-skill provenance checks. Credential forwarding to `$ISE_MCP_SCRIPT` and outbound logging to GAIT are proportionate features with unresolved trust boundaries, so this is not clearly malicious but carries medium-to-high security risk.