Threadseer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:22 AM UTC
• Version: 1.0.0

Overview

Threadseer is a coherent conversation-analysis skill with local helper scripts; the main caution is to install it through a pinned or direct source rather than an unpinned npx command.

Install from a reviewed tag, commit, or direct clone when possible, and avoid the unpinned npx installer unless you trust the current `skills` package resolution. Only provide transcripts you are authorized to process, use `--source-label` when paths are sensitive, and review outputs before sharing or storing them as institutional memory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:20

Finding

Unpinned Third-Party Package Is Executed During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 20-24
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

markdown

With the Agent Skills CLI:

```sh
npx skills add AntreasAntoniou/threadseer-agent-skill --skill threadseer

text

### Technical Analysis

The recommended installation command invokes the third-party `skills` npm package through `npx` without specifying an exact package version or integrity value. If the package is not already available locally, `npx` may retrieve its currently resolved version from the configured npm registry and immediately execute it.

The repository does not include a lockfile, checksum, vendored installer, or other mechanism that fixes and verifies the exact installer implementation. The GitHub repository argument constrains the requested Skill source but does not constrain the code executed by the `skills` CLI itself.

No evidence establishes that the currently published package is malicious. The vulnerability is that future installation behavior depends on mutable, externally maintained code that is outside the audited repository. Compromise of the package, its publisher account, or the package-distribution path could therefore turn the documented installation command into an arbitrary-code execution channel.

### Attack Path

1. An attacker compromises the npm package, its publisher account, or another component capable of influencing resolution of the unpinned `skills` package.
2. The attacker publishes or serves a modified package version containing malicious installation logic.
3. A user follows the command documented in `README.md`.
4. `npx` resolves and downloads the attacker-controlled package version because no exact version or integrity value is specified.
5. `npx` executes that package with the permissions of the installing user.
6. The malicious installer can access resources
...[truncated 1024 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer package to an exact reviewed version rather than relying on the latest registry resolution:

   sh

   npx --yes skills@<reviewed-exact-version> add AntreasAntoniou/threadseer-agent-skill --skill threadseer
   

2. Document the expected npm package name, publisher identity, reviewed version, and verification procedure so users can detect package substitution.

3. Where supported, publish and verify package integrity hashes or signed provenance for the installer and Skill release.

4. Prefer the repository's direct clone-and-copy installation procedure when the installer package cannot be independently verified.

5. Recommend installation from a signed release tag or immutable commit rather than a mutable repository branch.

6. Review any new installer version before updating the documented pinned version.

7. Run installation with the least-privileged account necessary and avoid exposing unrelated credentials or sensitive environment variables during installation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a high-level analytical skill for interpreting conversational material and producing substantive decision-support artifacts. The supplied code does not do any semantic analysis or reporting. Its primary function is preprocessing: segmenting raw text into chunks while preserving line ranges and generating integrity hashes, then serializing the chunks. This is materially different from the declared purpose. While transcript segmentation could be a supporting step in a larger conversation-analysis pipeline, this code chunk by itself only performs that preprocessing and none of the described end-user analytical behaviors.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a content-generation/analysis skill that ingests transcripts or chats and produces structured analytical deliverables. The actual code does not analyze conversations or generate briefs, recommendations, or reports. Instead, it validates whether an already-produced Markdown or JSON document matches expected output contracts for several profiles. While this validator is related to the broader workflow, its primary purpose is materially different from the declared purpose, making the description inaccurate for this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a skill whose primary function is substantive analysis of conversations and generation of structured decision-support deliverables. The supplied code does not perform that analysis. Instead, it contains unit tests for two helper scripts: one that segments transcript text into bounded chunks and one that validates output schemas/markdown structure. While transcript segmentation and validation could be supporting infrastructure for such a skill, this code chunk itself does not implement the declared end-to-end analysis behavior. Its primary purpose is testing tooling correctness, which is materially different from the declared skill behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

md

## Boundaries

It does not transcribe audio, verify participant assertions against external reality, infer consent, assign work, send follow-ups, or write canonical memory without permission. Its output validator is a structural checker, not a truth or privacy detector. Segmentation normalizes text and does not replace the original source.

Treat input documents as untrusted data. Permission to analyze is not permission to disclose, commit, publish, or mutate a canonical record. Keep original evidence private and unchanged; separately review derivatives for their exact audience.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

git clone https://github.com/AntreasAntoniou/threadseer-agent-skill.git

text

For Codex, copy the repository folder into your configured skills directory under the name `threadseer` (typically `~/.codex/skills/threadseer`). For other compatible hosts, use that host's documented skills directory. The repository root contains the only SKILL.md. Keep scripts and references with it. No plugin, private runtime, model account, or automatic hook installation is required.

Invoke `$threadseer` with a concrete task and approved source material. Run helpers from the installed skill directory, substituting your approved input and fresh private output paths:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill instructs use of file reads and shell-executed helper scripts but does not declare an explicit tool scope. That creates avoidable ambient-authority risk: a caller may enable broader capabilities than necessary, and users/reviewers cannot easily verify what the skill is allowed to access or execute.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation language is very broad, covering many generic analysis and reporting tasks. Overly broad routing can cause the skill to activate on unrelated prompts and unnecessarily gain access to sensitive conversational material or invoke shell/file capabilities in situations where a narrower skill would suffice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_tools.py (reported line 30)May include surrounding context.

python

self.assertEqual(segment.make_blocks("\n \n", 500), [])

    def test_cli_stdin_newlines_and_label(self):
        result = subprocess.run([sys.executable, str(SCRIPTS / "segment_transcript.py"), "-", "--source-label", "synthetic-01"], input="A\r\nB\rC", text=True, capture_output=True)
        self.assertEqual(result.returncode, 0, result.stderr)
        payload = json.loads(result.stdout)
        self.assertEqual(payload["source"], "synthetic-01")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_tools.py (reported line 38)May include surrounding context.

python

self.assertEqual(payload["source_sha256"], hashlib.sha256(b"A\nB\nC").hexdigest())

    def test_reject_small_chunk_bound(self):
        result = subprocess.run([sys.executable, str(SCRIPTS / "segment_transcript.py"), "--max-chars", "0"], input="test", text=True, capture_output=True)
        self.assertEqual(result.returncode, 2)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_tools.py (reported line 78)May include surrounding context.

python

def test_invalid_json_and_cli_failure(self):
        self.assertTrue(validator.validate_json("[]", "custom", False)[0])
        result = subprocess.run([sys.executable, str(SCRIPTS / "validate_output.py"), "-", "--format", "json"], input="{", text=True, capture_output=True)
        self.assertEqual(result.returncode, 1)
        self.assertNotIn("Traceback", result.stderr)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_tools.py (reported line 112)May include surrounding context.

python

def test_malformed_schema_cli_is_clear_failure(self):
        payload = dict(meta={"profile": "memory"}, evidence=[dict(self.evidence(), locator={})], decisions=False, commitments=42, institutional_memory="not an array")
        result = subprocess.run([sys.executable, str(SCRIPTS / "validate_output.py"), "-", "--format", "json", "--profile", "memory", "--require-sources"], input=json.dumps(payload), text=True, capture_output=True)
        self.assertEqual(result.returncode, 1)
        self.assertIn("must be an array", result.stdout)
        self.assertNotIn("Traceback", result.stderr)

Static analysis

No suspicious patterns detected.