Yarn - Control and Access Threads.com via the CLI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:04 AM UTC
• Version: 0.1.3

Overview

The skill is purpose-aligned for using Threads, but it gives an agent sensitive account access and posting ability without enough scoping or credential-safety guidance.

Install only if you are comfortable giving a third-party CLI access to your Threads account. Prefer a reviewed, pinned version in an isolated environment, avoid pasting session or CSRF tokens into chat or command history, and require explicit user approval before reading private feeds/saved content or posting publicly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Global Installation of a Security-Sensitive Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash

npm install -g yarn-threads-cli

Technical Analysis

The skill instructs users to install yarn-threads-cli globally without specifying an exact version, integrity hash, lockfile, or other artifact-verification mechanism. Consequently, the command resolves to whichever package version the npm registry currently serves.

npm packages can define lifecycle scripts that execute during installation with the privileges of the invoking user. Because this CLI is expected to access browser profiles or manually supplied Threads session credentials, compromise of the package, its publisher account, or a future release could expose security-sensitive authentication material. Global installation also makes the package available system-wide for that user and broadens the potential effect beyond an isolated project environment.

The repository contains only documentation and does not bundle the dependency's source, so the behavior of the installed artifact cannot be verified from the audited project.

Attack Path

1. An attacker compromises the npm package, its publisher account, or its dependency chain and publishes a malicious release.
2. A user follows the documented npm install -g yarn-threads-cli instruction.
3. npm resolves the unpinned package name to the attacker-controlled release.
4. Malicious package code may execute through installation lifecycle scripts or when the CLI is invoked.
5. The malicious code runs with the user's privileges and may inspect accessible files, browser-profile data, or Threads credentials supplied to the CLI.
6. Stolen credentials could then be used to read private account data or perform actions through the victim's Threads account.

Impact Assessment

Successful exploitation could provide arbi ...[truncated 554 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact version that has undergone security review, for example:

   bash

   npm install -g yarn-threads-cli@X.Y.Z
   

2. Publish and verify the expected npm artifact integrity hash before installation.
3. Prefer a project-local installation governed by a committed lockfile instead of a global installation.
4. Review the package source, transitive dependencies, and lifecycle scripts for the pinned release.
5. Where compatible with the package, install with lifecycle scripts disabled:

   bash

   npm install --ignore-scripts yarn-threads-cli@X.Y.Z
   

6. Run the CLI in a least-privileged, isolated environment with access only to the browser profile or credentials required for the operation.
7. Document a trusted package source and a repeatable verification procedure for users.
8. Avoid passing session and CSRF tokens directly as command-line arguments, because command lines may be retained in shell history or exposed through process inspection. Prefer protected environment variables, standard input, or a permission-restricted credential store if supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to authenticate by reusing browser profiles or extracting manual session cookies from DevTools, but it provides no warning that these artifacts are highly sensitive account credentials. In an agent/skill context, this is dangerous because users may expose persistent session tokens or grant the tool broad access to their social account without understanding the privacy and account-takeover risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented flags accept raw authentication materials such as session and CSRF tokens, but provide no warning that these values are sensitive secrets equivalent to account access. In an agent context, users may paste tokens into prompts, logs, shell history, or telemetry, creating a realistic path to credential leakage and account compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The reference describes commands that retrieve home feed, likes, and saved/bookmarked posts without any warning that these are potentially private, sensitive user data sets. In a skill used by an autonomous or semi-autonomous agent, omission of privacy guidance makes over-collection, unnecessary retention, or disclosure of personal content more likely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The command reference exposes follower and following enumeration features that are not disclosed in the skill's higher-level description. This mismatch increases the risk of covert capability expansion: users or downstream agents may invoke social-graph collection without realizing the skill enables it, which can facilitate privacy-invasive profiling or bulk relationship mapping.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.