Security audit

treeline

Security checks for vulnerabilities and agentic risk

Overview

The skill appears finance-focused and not malicious, but it installs an unpinned native CLI and tells the agent to persist financial context without clear consent controls.

Install only if you trust Treeline's release channel and are comfortable with the agent reading your local financial database. Before use, verify the CLI source/version independently, avoid allowing automatic upgrades from latest links, and do not let the agent store financial preferences or account meanings in memory unless you explicitly choose what is saved.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:6
Finding: Mutable External Executables Are Downloaded Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:210
Finding: Sensitive Financial Context Is Directed Into Persistent Agent Memory Without Explicit Consent
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.
tl demo on|off # Toggle demo mode (sample data)

text
> **Tip:** `--dry-run` variants are read-only and safe to run without confirmation. Use them to preview before asking the user to confirm the actual operation. **Use `tl compact` if the user mentions slow queries** — it optimizes the database.

Static analysis

No suspicious patterns detected.