TreeListy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:01 AM UTC
• Version: 1.0.0

Overview

This is mostly a local project-planning skill, but its optional push command can send tree data and a token over unencrypted WebSocket to any host even though the documentation frames it as localhost-only.

Install only if you are comfortable with a local Node CLI and avoid using the push command with remote hosts or sensitive tree contents until it restricts destinations to loopback or supports authenticated encrypted connections. Treat CSV exports as untrusted when opening them in spreadsheets, update the ws dependency, and use the freespeech pattern only with informed consent from anyone whose transcript is being analyzed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/push.js:29

Finding

Arbitrary Remote Host Allows Plaintext Disclosure of Tree Data and Authentication Tokens

Content

View full analysis

{ const wsUrl = `ws://${host}:${port}`; // Connection timeout const connectTimer = setTimeout(() => { ws.close(); reject(new Error(`Connection timeout - is TreeListy running with MCP bridge on port ${port}?`)); }, CONNECT_TIMEOUT); const ws = new WebSocket(wsUrl); ws.on('open', () => { clearTimeout(connectTimer); // Send handshake with token if provided const handshake = { type: 'handshake', source: 'openclaw-skill', version: '1.0.0', token: token }; ws.send(JSON.stringify(handshake)); }); ``` After the hands ...[truncated 2641 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/export.js:154

Finding

CSV Export Does Not Neutralize Spreadsheet Formula Injection

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented primarily as a local planning/decomposition tool, but it also documents a push capability that connects to a browser-based bridge on a port and sends data to a running TreeListy instance. That hidden or underemphasized network behavior expands the trust boundary, creates opportunities for unintended data exfiltration or interaction with external/local services, and is especially relevant in agent environments where users may expect purely local formatting operations.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: treelisty
description: Hierarchical project decomposition and planning. Use when breaking down complex projects, structuring information, planning multi-step workflows, or organizing any nested hierarchy. Supports 21 specialized patterns (WBS, GTD, Philosophy, Sales, Film, etc.) and exports to JSON, Markdown, and Mermaid diagrams.
license: Apache-2.0
metadata:
  author: prairie2cloud
  version: "1.0.0"
  openclaw:
    requires:
      bins: ["node"]
---

# TreeListy Skill

TreeListy is your hierarchical decomposition engine. When you need to break down a complex topic, plan a project, or structure inform

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.

md

node scripts/treelisty-cli.js patterns

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile pins the skill to ws 8.19.0, and the supplied advisory data indicates this version is affected by an uninitialized memory disclosure issue and a memory-exhaustion denial-of-service issue. Because this skill exposes a CLI and includes a WebSocket library, any code path that accepts untrusted WebSocket input could allow remote attackers to crash the process or potentially disclose sensitive memory contents.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

If this package range resolves to ws 8.19.0, the project would include a version reported as affected by memory disclosure and memory exhaustion denial-of-service issues. Even though this file alone does not prove the vulnerable version is installed, the declared semver range allows that version, making the dependency risk real for consumers who install or update without a restrictive lockfile.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'freespeech' pattern explicitly advertises psychological pattern detection and hidden-pattern interpretation of transcription data, which goes beyond neutral hierarchical planning into sensitive inference about mental state or inner beliefs. This creates a meaningful risk of privacy invasion, manipulative profiling, and unsafe analysis of sensitive user data without clear consent or safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The freespeech pattern invites psychological analysis of voice or transcription content, including hidden patterns, contradictions, and implicit beliefs, without warning users about the sensitivity of such profiling. This is dangerous because it can normalize invasive inference from speech data and encourage unsupported or harmful conclusions about a person’s psychology.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.