TreeListy

Hierarchical project decomposition and planning. Use when breaking down complex projects, structuring information, planning multi-step workflows, or organizing any nested hierarchy. Supports 21 specialized patterns (WBS, GTD, Philosophy, Sales, Film, etc.) and exports to JSON, Markdown, and Mermaid diagrams.

TreeListy is mostly coherent with its description: it runs local Node scripts to decompose and export hierarchical trees and optionally pushes to a running TreeListy instance. Before installing or running it, do the following checks: 1) Inspect SKILL.md and README for hidden or non-printable characters (open in a hex editor or run a filter to show/control chars). The pre-scan flagged possible prompt-injection patterns — treat those as suspicious until proven benign. 2) Review push.js and the CLI: the push command is intended to connect to localhost (a browser-based MCP bridge), but the code accepts a host parameter — do not use a remote host unless you trust it. If you will run this skill in an environment with sensitive internal services, avoid using the push feature or restrict it to localhost. 3) Run npm install only from a trusted environment and run npm audit on dependencies (only 'ws' is declared). 4) If you plan to let the agent invoke the skill autonomously, be aware the skill can read user-specified files (input paths) — ensure you don't pass sensitive files as input. 5) If you want higher assurance, request the upstream repository/source (homepage is missing) or ask the author for a signed release; otherwise treat this as unverified community code. If anything in SKILL.md looks obfuscated or contains hidden characters, do not install until the artifact is cleaned or verified.

Type: OpenClaw Skill Name: treelisty-openclaw-skill Version: 1.0.0 The OpenClaw AgentSkills skill bundle is classified as benign. The skill's core functionality involves local text processing and hierarchical data structuring using Node.js scripts. The only network activity identified is an optional `push` command in `scripts/push.js` and `scripts/treelisty-cli.js`, which establishes a WebSocket connection to `localhost:3456`. This connection is explicitly for integrating with a local companion application (TreeListy's visual canvas) and is clearly documented in `SKILL.md` and `README.md`. There is no evidence of data exfiltration to external endpoints, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the agent. All operations are local and align with the stated purpose of hierarchical project decomposition.