TreeListy

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:09 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent local planning and export tool with a documented optional local WebSocket push feature, but users should avoid sending sensitive trees to untrusted destinations.

Install if you are comfortable with a Node CLI that processes your local tree files. Treat exported trees as potentially sensitive, especially when using family, email, filesystem, knowledge-base, or speech-analysis patterns. Use push only with your own trusted local TreeListy bridge unless you intentionally want to send the tree to another host.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The module adds a networked data-transmission capability that is not clearly reflected in the skill description, which frames the skill as planning/export oriented. Hidden or under-disclosed outbound connectivity increases the risk of unintended data exposure, especially if users supply sensitive project trees and do not expect them to be sent to a live service.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: This code performs WebSocket communication and RPC-style invocation of a remote 'load_tree' tool, which is a materially broader capability than simple local planning or export. Even if intended for legitimate integration, such remote invocation can move user data to another process or host and expands the attack surface beyond what the skill description suggests.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The CLI imports and exposes push/checkConnection network functionality even though the skill is described primarily as a local planning/decomposition tool. In an agent context, undocumented outbound connectivity expands the trust boundary and can cause sensitive tree content to be transmitted to a local or remote service unexpectedly if higher-level orchestration invokes the push path.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The push command performs active network connectivity checks and sends parsed tree data to a host/port supplied at runtime, with only a default of localhost and no visible enforcement of safe destinations in this file. For a planning/export skill, this is a meaningful capability expansion because project plans may contain confidential business details, and an agent could be induced to exfiltrate them to an attacker-controlled endpoint if the host parameter is overridden or surrounding controls are weak.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This section documents patterns for genealogy and family-history tracking that explicitly encourage collection of sensitive personal and quasi-identifying data such as birth dates, places, marriage data, occupation, DNA information, and sources, but provides no privacy, consent, retention, or sharing warning. In an agent skill context, this omission can normalize unsafe collection and storage of third-party personal data, increasing the risk of privacy violations, unauthorized disclosure, and regulatory noncompliance.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The freespeech pattern explicitly supports voice transcription analysis, stream-of-consciousness capture, psychological pattern detection, verbatim quotation, and inferred 'insight' fields without any warning about consent, legality of recording/transcription, or the sensitivity of inferred mental-state data. That is dangerous because it can facilitate covert surveillance, profiling, or creation of highly sensitive behavioral records from speech, especially when paired with export features that make such data easy to preserve and distribute.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The familytree pattern defines fields for highly sensitive personal and genealogical data, including birth/death details, marriage history, DNA information, and relationships, but the code contains no disclosure, consent, minimization, or handling safeguards. In an agent skill that structures and exports data, this can lead users to collect and process sensitive personal data without adequate privacy notice or controls.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The gmail pattern is designed to capture email bodies, recipients, senders, labels, and thread identifiers, which are commonly sensitive and may include confidential communications. Because the pattern definition lacks any warning or privacy constraints, users or downstream integrations may ingest and expose message content without informed consent or clear boundaries.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The freespeech pattern explicitly supports voice capture plus psychological pattern analysis, including quoted speech, contradictions, implicit beliefs, and psychological interpretation. This is especially sensitive because it encourages collection of intimate speech data and inference of mental or emotional traits without any embedded warning, consent requirement, or caution about misuse and over-interpretation.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"treelisty": "scripts/treelisty-cli.js"
  },
  "dependencies": {
    "ws": "^8.16.0"
  }
}

• Confidence: 95% confidence
• Finding: "ws": "^8.16.0"

Known Vulnerable Dependency: ws==8.16.0 — 3 advisory(ies): CVE-2024-37890 (ws affected by a DoS when handling a request with many HTTP headers); CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: ws==8.16.0

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.