homes

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:13 PM UTC
• Version: 1.4.4

Overview

This homes.com skill is read-only and openly described, but it asks users to run unpinned external code and a browser extension through a signed-in browser session.

Install only if you are comfortable letting an external MCP package and a browser extension interact with your signed-in homes.com session. Prefer pinning the npm package to a reviewed version, reviewing the fetchproxy extension source and permissions, and invoking saved homes or saved searches only after an explicit user request.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19
• Finding: Unpinned Third-Party Package Download and Execution## Vulnerability Details **File Location**: `SKILL.md:19-27` **Vulnerability Type**: Unpinned npm dependency executed through `npx` **Risk Level**: Medium ### Vulnerable Code ```json `.mcp.json` (project) or `~/.claude/mcp.json` (global): { "mcpServers": { "homes": { "command": "npx", "args": ["-y", "homes-mcp"] } } } ``` ### Technical Analysis The documented configuration runs `npx -y homes-mcp` without specifying a reviewed package version or integrity value. Consequently, `npx` can download and execute whichever release is currently resolved under that package name. The `-y` option suppresses the installation confirmation, further reducing the opportunity for users to inspect the resolved version before execution. The dependency implementation is not included in this project, so this audit cannot verify its runtime behavior. This is a supply-chain exposure rather than proof that the current package is malicious. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or its publication pipeline. 2. The attacker publishes a malicious release under the existing `homes-mcp` package name. 3. A user follows the documented setup or starts the configured MCP server. 4. `npx -y homes-mcp` resolves, downloads, and executes the compromised release without a version pin or interactive confirmation. 5. The malicious process runs with the operating-system privileges and data access of the user launching the MCP client. ### Impact Assessment A compromised package could execute arbitrary code under the invoking user's account. Depending on the host environment, this may permit access to readable files, MCP configuration, environment variables, network resources, and other user-accessible data. Because the MCP is intended to interact with an authenticated homes.com workflow, a malicious implementation could also attempt to misuse data delivered through that workflo ...[truncated 111 chars]
• Remediation: ## Remediation Suggestions - Pin `homes-mcp` to a specific, reviewed version, for example `homes-mcp@X.Y.Z`. - Review the selected release and verify its npm provenance, publisher identity, repository linkage, and integrity metadata before deployment. - Use a controlled installation process with a lockfile and retained integrity hashes where the MCP host supports it. - Remove `-y` from first-time installation instructions so users can inspect the package and resolved version before execution. - Prefer installing an approved version in advance and configuring the MCP host to invoke the audited local binary. - Monitor dependency advisories and require explicit review before upgrading the pinned version.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29
• Finding: Unpinned External Browser Extension Installation## Vulnerability Details **File Location**: `SKILL.md:29-34` **Vulnerability Type**: Unverified external browser-extension dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ### 2. Install the fetchproxy extension (one-time, shared across all fetchproxy-based MCPs) The extension lives in its own repo and is installed separately — it is **not** bundled in this repo. Follow the install instructions at [github.com/chrischall/fetchproxy](https://github.com/chrischall/fetchproxy), then load the built extension in Chrome via `chrome://extensions` → Developer mode → Load unpacked. ``` ### Technical Analysis The setup delegates installation to instructions in a mutable external repository and directs users to load the resulting extension unpacked. No reviewed commit, signed release, checksum, or required-permission manifest is specified. The effective extension code can therefore differ from what was present when this Skill was reviewed. Browser-extension access is security-sensitive because the documented design routes requests through a signed-in homes.com tab. Such access is functionally relevant to the Skill, but the absence of immutable dependency references and permission documentation prevents users from verifying that the extension is constrained to the minimum access necessary. This finding establishes supply-chain risk; it does not establish that the referenced extension currently contains malicious code. ### Attack Path 1. An attacker compromises the external repository, a maintainer account, its release pipeline, or the installation instructions. 2. The attacker changes the extension source or build procedure to include malicious behavior. 3. A user follows the mutable repository instructions and builds or downloads the altered extension. 4. The user enables Developer mode and loads the extension unpacked. 5. The altered extension operates with the permissions declared in its manifest and may access ...[truncated 700 chars]
• Remediation: ## Remediation Suggestions - Pin the extension to a reviewed commit hash or signed, immutable release. - Publish and verify cryptographic checksums for distributed extension artifacts. - Document the exact build commands and use reproducible builds where possible. - Document every requested browser permission and justify it against the homes.com-only functionality. - Restrict host permissions to the minimum required homes.com and local bridge origins; avoid broad patterns such as access to all websites. - Avoid cookie access, arbitrary tab access, and unrestricted content-script injection unless strictly necessary. - Prefer a signed distribution channel over loading unpacked mutable source. - Require a security review before changing the pinned extension version or its permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

MCP Config Access

High

• Category: Agent Snooping

Content

### 1. Install homes-mcp

`.mcp.json` (project) or `~/.claude/mcp.json` (global):

```json
{

• Confidence: 95% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger text is overly broad because it activates on essentially any request involving homes.com properties, prices, history, or photos, which can cause the skill to run in contexts the user did not clearly intend. In this skill, that matters because the toolset can access signed-in session data and scrape through a real browser session, increasing the chance of unintended data access or disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill exposes tools for reading saved homes and saved searches from a signed-in homes.com session without a prominent user-facing privacy warning or explicit consent requirement. Because the MCP routes through the user's authenticated browser tab, a broad trigger or ambiguous prompt could surface private account data that the user did not realize would be accessed.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Response shape (`view`)

Five tools take `view: "compact" | "full"`, and **`compact` is the default** —
you get the slim shape without asking for it: `homes_search_properties`,
`homes_get_property`, `homes_bulk_get`, `homes_compare_properties`,
`homes_get_market_report`.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.