TreeListy

• Outcome: Pass
• Latest audit: May 28, 2026, 4:47 AM
• Version:
  1.0.0

Overview

TreeListy is a coherent local planning skill with an optional, user-directed WebSocket push feature that should be used only with trusted destinations.

Install only if you are comfortable using a Node-based local CLI with the ws dependency. Avoid putting secrets, regulated data, or third-party personal details into trees unless you have permission and a retention plan. Use the push command only with your own trusted local TreeListy bridge; do not pass a token or use --host for a remote destination unless you trust that endpoint and network.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module transmits full tree data to a live service over a WebSocket, which expands the skill from local planning/export into networked data exfiltration or remote delivery. In the context of a planning skill, trees may contain sensitive project structure, tasks, notes, or identifiers, and the code allows sending that data to an arbitrary host without clear restriction or explicit user-consent enforcement in the module itself.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code builds a WebSocket URL from user-supplied host and port and initiates outbound connectivity, including to non-local hosts, despite the skill being described primarily as a decomposition/export tool. This creates SSRF-like or unintended outbound communication capability that could be abused to send internal planning data to attacker-controlled infrastructure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The family tree pattern explicitly encourages collection of highly sensitive personal and quasi-identifying data, including birth/death details, spouse names, occupations, photos, and DNA information, without any privacy notice, minimization guidance, or handling restrictions. In a planning/organization skill, this normalizes storing sensitive family data that could enable identity theft, doxxing, profiling, or non-consensual processing of relatives' information.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The email workflow pattern describes storing recipient addresses, subject lines, message bodies, and thread identifiers without warning users that this may include personal, confidential, or regulated communications data. In an agent skill context, this increases the risk of accidental ingestion, retention, sharing, or downstream processing of sensitive correspondence.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The freespeech pattern goes beyond transcription and explicitly promotes psychological pattern detection, hidden pattern analysis, contradictions, silences, and implicit beliefs, which can infer sensitive mental-state or personality information from speech. Without strong warnings, consent requirements, and limits on inference, this creates elevated privacy and profiling risk, especially because users may process recordings involving third parties or vulnerable individuals.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The `familytree` pattern explicitly models highly sensitive personal and familial data, including birth/death details, marriage information, occupation, photo URLs, and especially `dnaInfo`. Even though this file is only a schema/config definition, exposing these collection fields without any built-in warning, consent prompt, minimization guidance, or sensitivity labeling materially increases the risk that downstream UI will solicit and store regulated or intimate personal data without adequate safeguards.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The `gmail` pattern is designed to ingest email thread content and metadata such as recipients, message bodies, sender identities, and thread IDs, all of which can contain confidential, personal, or business-sensitive information. A pattern that normalizes collection of this data without any warning, classification, or restrictions can lead downstream components to process private communications unsafely or beyond user expectations.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The `freespeech` pattern goes beyond ordinary note-taking by encouraging collection of verbatim speech plus inferred psychological interpretations, hidden patterns, contradictions, and emotional intensity. That combination creates a high-risk profiling capability involving potentially sensitive behavioral and mental-state inferences, and the absence of warnings or safeguards makes misuse or overcollection substantially more likely.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The module sends both tree contents and an optional authentication token over a plain ws:// connection with no built-in disclosure, consent flow, or transport security. That combination can expose sensitive data and credentials to local or network interception, especially if the host is changed from localhost to a remote system.

VirusTotal

66/66 vendors flagged this skill as clean.