TreeListy

Hierarchical project decomposition and planning. Use when breaking down complex projects, structuring information, planning multi-step workflows, or organizing any nested hierarchy. Supports 21 specialized patterns (WBS, GTD, Philosophy, Sales, Film, etc.) and exports to JSON, Markdown, and Mermaid diagrams.

Security Scan

The skill's code and behavior largely match its description, but automated scanners flagged prompt-injection patterns in SKILL.md and the CLI can open WebSocket connections to arbitrary hosts (intended for a localhost bridge) — those mismatches merit extra review before installing.

Purpose & Capability

The name/description (hierarchical decomposition, 21 patterns, exports) matches the included files: decompose, export, patterns, validate, push and a CLI. Requesting node makes sense. No unexpected credentials or unrelated binaries are required.

Instruction Scope

SKILL.md simply instructs the agent to run the local Node CLI scripts (patterns, decompose, export, validate, push). The CLI reads user-supplied files or stdin (expected). However the pre-scan flagged 'system-prompt-override' and 'unicode-control-chars' patterns in SKILL.md — I could not find an obvious explicit system-prompt overwrite in the visible text, so this may be a false positive or hidden characters; it should be inspected for invisible/control characters or embedded instructions before trusting it.

Install Mechanism

There is no registry install spec in the skill bundle. The package.json and package-lock.json show a single npm dependency (ws) fetched from the public npm registry — a low/expected install footprint. No downloads from personal servers or shortened URLs are present.

Credentials

The skill requests no environment variables, no credentials, and no config paths. The behavior (reading only user-specified input files and optional local push) is proportionate to the stated purpose.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It does not modify other skills or system-wide configs. CLI can be invoked autonomously per platform defaults, but that is normal and flagged as expected.

Scan Findings in Context

[system-prompt-override] unexpected: The static pre-scan detected patterns that often indicate attempts to inject instructions into the agent's system prompt. The visible SKILL.md looks like a normal manifest, so this may be a false positive or due to hidden/unicode-control characters. Inspect SKILL.md for invisible control chars or unusual YAML that could try to influence the agent runtime.

[unicode-control-chars] unexpected: Control/unicode-override characters were detected in SKILL.md. These can be used to hide text or alter how the file is interpreted. Even if content appears benign, verify the file with a hex viewer or strip control characters before use.

What to consider before installing

TreeListy is mostly coherent with its description: it runs local Node scripts to decompose and export hierarchical trees and optionally pushes to a running TreeListy instance. Before installing or running it, do the following checks: 1) Inspect SKILL.md and README for hidden or non-printable characters (open in a hex editor or run a filter to show/control chars). The pre-scan flagged possible prompt-injection patterns — treat those as suspicious until proven benign. 2) Review push.js and the CLI: the push command is intended to connect to localhost (a browser-based MCP bridge), but the code accepts a host parameter — do not use a remote host unless you trust it. If you will run this skill in an environment with sensitive internal services, avoid using the push feature or restrict it to localhost. 3) Run npm install only from a trusted environment and run npm audit on dependencies (only 'ws' is declared). 4) If you plan to let the agent invoke the skill autonomously, be aware the skill can read user-specified files (input paths) — ensure you don't pass sensitive files as input. 5) If you want higher assurance, request the upstream repository/source (homepage is missing) or ask the author for a signed release; otherwise treat this as unverified community code. If anything in SKILL.md looks obfuscated or contains hidden characters, do not install until the artifact is cleaned or verified.

TreeListy Skill

TreeListy is your hierarchical decomposition engine. When you need to break down a complex topic, plan a project, or structure information in a tree format, use TreeListy.

When to Use This Skill

Use TreeListy when:

• Decomposing complex tasks — Break a large goal into phases, items, and actionable tasks
• Project planning — Create WBS, roadmaps, or strategic plans with proper hierarchy
• Structuring analysis — Organize arguments (philosophy), dialogues, or knowledge bases
• Content organization — Plan books, courses, theses, or event schedules
• Visual documentation — Generate Mermaid diagrams for any hierarchical structure

Quick Start

# List available patterns
node scripts/treelisty-cli.js patterns

# Create a structured decomposition
node scripts/treelisty-cli.js decompose --pattern wbs --input "Build a mobile app"

# Export to Mermaid diagram
node scripts/treelisty-cli.js export --input tree.json --format mermaid

The 21 Patterns

Pattern	Icon	Best For
generic	📋	General projects, default structure
sales	💼	Sales pipelines, quarterly deals
thesis	🎓	Academic papers, dissertations
roadmap	🚀	Product roadmaps, feature planning
book	📚	Books, novels, screenplay structure
event	🎉	Event planning, conferences
fitness	💪	Training programs, workout plans
strategy	📊	Business strategy, OKRs
course	📖	Curricula, lesson plans
film	🎬	AI video production (Sora, Veo)
veo3	🎥	Google Veo 3 workflows
sora2	🎬	OpenAI Sora 2 workflows
philosophy	🤔	Philosophical arguments, dialogues
prompting	🧠	Prompt engineering libraries
familytree	👨‍👩‍👧‍👦	Genealogy, family history
dialogue	💬	Debate analysis, rhetoric
filesystem	💾	File/folder organization
gmail	📧	Email workflows
knowledge-base	📚	Document corpora, RAG prep
capex	💰	Capital expenditure, investor pitches
freespeech	🎙️	Voice capture pattern analysis
lifetree	🌳	Biographical timelines
custom	✏️	Define your own level names

Commands

patterns — Discover available patterns

# List all patterns
node scripts/treelisty-cli.js patterns

# Get details for a specific pattern
node scripts/treelisty-cli.js patterns --name philosophy

# Get full JSON schema
node scripts/treelisty-cli.js patterns --name philosophy --detail

decompose — Create structured trees

Takes text input (topic, outline, or structured text) and applies a pattern template.

# Simple topic
node scripts/treelisty-cli.js decompose \
  --pattern roadmap \
  --input "Q1 Product Roadmap for AI Assistant" \
  --format json

# From structured input (markdown headers, indented lists)
echo "# Marketing Campaign
## Research Phase
- Market analysis
- Competitor review
## Execution Phase
- Content creation
- Launch ads" | node scripts/treelisty-cli.js decompose --pattern strategy --format json

# Output as Mermaid
node scripts/treelisty-cli.js decompose \
  --pattern wbs \
  --input "Website Redesign Project" \
  --format mermaid

Options:

• --pattern <key> — Pattern to apply (default: generic)
• --input <text|file> — Topic text, file path, or stdin
• --name <name> — Override root node name
• --depth <1-4> — Maximum tree depth
• --format <fmt> — Output: json, markdown, mermaid

export — Convert trees to other formats

# To Markdown
node scripts/treelisty-cli.js export --input tree.json --format markdown

# To Mermaid diagram
node scripts/treelisty-cli.js export --input tree.json --format mermaid

# To CSV
node scripts/treelisty-cli.js export --input tree.json --format csv

# To checklist
node scripts/treelisty-cli.js export --input tree.json --format checklist

Formats: json, markdown, mermaid, csv, checklist, html

validate — Check tree quality

# Human-readable report
node scripts/treelisty-cli.js validate --input tree.json

# JSON report
node scripts/treelisty-cli.js validate --input tree.json --format json

Returns:

• Quality score (0-100)
• Structure analysis (node counts, depth, balance)
• Issues (errors, warnings, suggestions)
• Pattern compliance check

push — Send to live TreeListy (optional)

If the user has TreeListy open in their browser with MCP bridge enabled:

node scripts/treelisty-cli.js push \
  --input tree.json \
  --port 3456

This displays the tree in TreeListy's visual canvas for interactive exploration.

Tree Data Model

Trees follow this structure:

{
  "id": "n_abc12345",
  "treeId": "tree_xyz78901",
  "name": "Project Name",
  "type": "root",
  "pattern": "roadmap",
  "icon": "🚀",
  "description": "Optional description",
  "expanded": true,
  "children": [
    {
      "name": "Phase 1",
      "type": "phase",
      "items": [
        {
          "name": "Feature A",
          "type": "item",
          "patternType": "Core Feature",
          "subtasks": [
            {
              "name": "Implement login",
              "type": "subtask"
            }
          ]
        }
      ]
    }
  ]
}

Hierarchy: Root → Phases (children) → Items (items) → Subtasks (subtasks)

Each pattern adds custom fields. For example, roadmap adds storyPoints, userImpact, technicalRisk.

Workflow Example

1. Agent receives complex task from user

2. Decompose with appropriate pattern:

   node scripts/treelisty-cli.js decompose \
     --pattern wbs \
     --input "Build an e-commerce platform with user auth, product catalog, shopping cart, and checkout" \
     --format json > project.json
   

3. Validate the structure:

   node scripts/treelisty-cli.js validate --input project.json
   

4. Export for user consumption:

   node scripts/treelisty-cli.js export --input project.json --format mermaid
   

5. Share the Mermaid diagram in response to user.

No AI Tokens Used

All TreeListy operations are local pattern transformations. Zero API calls, zero token cost. The skill structures your content using 21 battle-tested hierarchical templates.

Learn More

• Full pattern reference: references/PATTERNS.md
• TreeListy visual app: https://treelisty.com
• Source: https://github.com/prairie2cloud/treelisty