TreeListy

TreeListy is mostly coherent with its description: it runs local Node scripts to decompose and export hierarchical trees and optionally pushes to a running TreeListy instance. Before installing or running it, do the following checks: 1) Inspect SKILL.md and README for hidden or non-printable characters (open in a hex editor or run a filter to show/control chars). The pre-scan flagged possible prompt-injection patterns — treat those as suspicious until proven benign. 2) Review push.js and the CLI: the push command is intended to connect to localhost (a browser-based MCP bridge), but the code accepts a host parameter — do not use a remote host unless you trust it. If you will run this skill in an environment with sensitive internal services, avoid using the push feature or restrict it to localhost. 3) Run npm install only from a trusted environment and run npm audit on dependencies (only 'ws' is declared). 4) If you plan to let the agent invoke the skill autonomously, be aware the skill can read user-specified files (input paths) — ensure you don't pass sensitive files as input. 5) If you want higher assurance, request the upstream repository/source (homepage is missing) or ask the author for a signed release; otherwise treat this as unverified community code. If anything in SKILL.md looks obfuscated or contains hidden characters, do not install until the artifact is cleaned or verified.