Threadseer

• Outcome: Pass
• Latest audit: Sep 5, 2026 · 7:53 PM UTC
• Version: 1.0.0

Overview

Threadseer is a coherent transcript-analysis skill with local helper scripts and no artifact-backed evidence of hidden execution, exfiltration, or unauthorized persistence.

Install from a reviewed source when possible, prefer the manual clone/copy route or a pinned verified installer, and do not run installer commands with administrator privileges. Use the skill only on transcripts you are authorized to process, remember that your agent host may send supplied content to its configured model provider, and review any generated shareable report or durable memory draft before posting or saving it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:22
• Finding: Unpinned Third-Party Package Execution During Installation## Vulnerability Details **File Location**: `README.md:22` **Vulnerability Type**: Unpinned npm package execution and supply-chain exposure **Risk Level**: Medium **Vulnerable Code:** ```sh npx skills add AntreasAntoniou/threadseer-agent-skill --skill threadseer ``` ### Technical Analysis The documented installation command invokes `skills` through `npx` without specifying an exact package version or verifying package integrity. If the package is not already available locally, `npx` may retrieve and execute the package version currently resolved by the npm registry. Consequently, the code executed during installation is not fully constrained to the contents of this audited repository. The effective installer can change after this repository has been reviewed. A compromised package publisher account, malicious package release, registry compromise, or unexpected future package behavior could introduce arbitrary executable code into the installation process. This finding concerns the documented installation path. The audited Python helpers themselves use the Python standard library and contain no identified remote code retrieval or malicious execution behavior. ### Attack Path 1. An attacker compromises the publisher account, release process, or distribution channel for the npm package resolved as `skills`, or causes a malicious version to be selected. 2. The attacker publishes a package version containing malicious installation-time or runtime behavior. 3. A user follows the documented `npx skills add ...` installation command. 4. `npx` retrieves the currently resolved, unpinned package version. 5. The retrieved package executes with the privileges of the user running the command. 6. Malicious code can access or modify resources available to that user before or while installing the Skill. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the invoking user's privileges. Dependi ...[truncated 514 chars]
• Remediation: ## Remediation Suggestions 1. Pin the installer package to a specific, reviewed version rather than resolving the latest available release. 2. Verify the selected package artifact using a trusted integrity digest or signed provenance before execution. 3. Document a manual installation method that does not require executing an independently changing package, such as cloning a specific reviewed commit and copying the Skill files. 4. If `npx` remains supported, instruct users not to run the installer with administrator or root privileges. 5. Periodically review the pinned installer version and update it through a controlled process that includes source review, integrity verification, and regression testing. 6. Clarify in the installation documentation that the npm installer is a separate trust boundary from this repository.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The default prompt invokes the skill with a very broad activation phrase and little task scoping beyond 'turn this transcript into an evidence-backed decision brief and action plan.' Because the skill is designed to process arbitrary conversational material, this broad trigger can cause the agent to apply high-trust summarization and recommendation behavior to untrusted or mixed-content inputs, increasing the chance of prompt-injection-through-transcript, overcollection, or unintended use outside the intended context.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.