Tree Of Thoughts

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:34 AM UTC
• Version: 2.0.0

Overview

This skill is a reasoning aid with no evidence of exfiltration or destructive behavior, but its documented cache and log workflows may retain sensitive prompts locally.

Install only if you are comfortable with a reasoning helper that may cache or log problem statements and decisions locally when those documented workflows are used. Disable caching or avoid session logging for confidential business, personal, security, or incident-response prompts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The declared description presents a specific reasoning capability: multi-path exploration and evaluation for complex problems. However, the supplied code chunk does not itself implement tree-of-thoughts or any branching/evaluation logic. Instead, it acts as a generic loader/adapter that imports an external file, instantiates the first class it finds, registers only a vague 'general' capability, and executes common method names on that loaded object. Because the actual behavior visible in this chunk is generic delegation and dynamic code execution rather than the stated reasoning functionality, the description does not accurately represent what this code chunk actually does.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The caching section proposes storing the user's problem text and reusing solutions for semantically similar prompts, but does not warn that user content may be retained and later surfaced from cache. In a reasoning skill, prompts often contain confidential strategy, architecture, or incident details, so silent caching creates a meaningful privacy and cross-session data leakage risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs tracking ToT sessions in a persistent file without clearly warning users that their prompts, decisions, and outcomes may be written to disk. This can expose sensitive business, personal, or security-relevant reasoning data to later users, other tools, or anyone with filesystem access.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The real usage example normalizes automatic creation of local files without an explicit notice that the skill may modify the filesystem. Unexpected file creation can leak sensitive content, clutter repositories, alter agent state, or violate least-surprise expectations in environments where write operations should require user consent.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

# Find the main class
            for name in dir(module):
                obj = getattr(module, name)
                if isinstance(obj, type) and name != "UnifiedSkill":
                    self._original = obj()
                    break

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

No suspicious patterns detected.