Is reskate safe

You can audit it, and you should still treat the download carefully. The source is public under GPL-3.0. The launcher loads a DLL into the game, so antivirus tools may flag it. This site hosts no files.

Can you read the source?

Yes. ReSkate is GPL-3.0. The code is in the GitHub repository. Read that tree if you want to see what the launcher does.

Why does antivirus complain?

ReSkate has to load itself into the game as it starts. Antivirus programs distrust that, especially for a new program. The project calls this a false alarm when the file came from the GitHub release and the hash matches the hash on that release. If Windows Security quarantined a file, open Protection history, find ReSkate, and choose Restore. An error about SHA-256 right after an update usually means the antivirus removed the new file.

Add an exclusion only for the files you downloaded from the GitHub release and hashed yourself. Do not exclude a copy from anywhere else.

Where do you sign in to Steam?

Only in the launcher. That is the Steam sign-in the project ships: a QR code, or your account with Steam Guard. Do not type your Steam password into any website, including this one.

Which mods should you install?

Only mods you trust. Mods change game data. Install them from the launcher MODS page or from the Thunderstore package page, then check the hash story on the ReSkate download itself.