onehome-fpx

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:21 PM UTC
• Version: 0.15.5

Overview

The skill is not clearly malicious, but it teaches users to extract and reuse OneHome session credentials with weak handling and broad private-data access.

Install only if you understand that this workflow handles OneHome account/session credentials. Use it only for your own OneHome share or a clearly authorized agent workflow, avoid saving tokens or full API responses to disk, prefer pinned/local tooling, and treat captured bearer tokens, email magic-link tokens, share tokens, and contact data as secrets.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:33
• Finding: Unpinned Global Installation of a Security-Sensitive Third-Party CLI<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 33 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```sh npm install -g @fetchproxy/cli # provides `fpx` ``` ### Technical Analysis The setup instructions install the latest available version of `@fetchproxy/cli` globally without pinning a reviewed version or verifying package integrity. This CLI occupies a security-sensitive position because the Skill subsequently uses it to pair with a browser extension, capture an `Authorization` header, and transmit authenticated OneHome API requests. Because npm installation can execute package lifecycle scripts, a compromised package release or publishing account could execute arbitrary code during installation. A future release could also silently alter credential-capture or request-routing behavior after this Skill has been reviewed. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or a future release process. 2. The attacker publishes a malicious version under the legitimate package name. 3. A user follows the Skill instructions and runs the unpinned global installation command. 4. npm downloads the malicious latest version and may execute its lifecycle scripts. 5. The malicious package executes with the user's privileges and can access files, environment variables, browser-bridge data, or subsequently handled OneHome credentials. ### Impact Assessment Successful exploitation could result in arbitrary code execution with the installing user's privileges. Because the CLI handles captured bearer tokens and browser-mediated sessions, exploitation could also expose OneHome session credentials, permit authenticated access within the victim's OneHome scope, tamper with API requests, or compromise other locally accessible data. The global installation increases exposure by placing the package in the user's shared command environment rather than isolat ...[truncated 51 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the dependency to an exact, reviewed version rather than installing the latest release. - Document the expected official package publisher and repository. - Verify the downloaded package using a trusted integrity hash or signed provenance where available. - Prefer a project-local installation governed by a committed lockfile instead of a global installation. - Disable npm lifecycle scripts during installation if the package does not require them. - Review package updates before changing the pinned version, particularly code related to browser pairing, header capture, and request forwarding. - Run the CLI with the minimum operating-system privileges and in an isolated environment where practical. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:55
• Finding: Authentication Secrets Written to Predictable Plaintext Temporary Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–60 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```sh printf '{"emailToken":"%s"}' "$EMAIL_TOKEN" > /tmp/checktoken-body.json fpx post-json 'https://services.onehome.com/api/authentication/checkToken' \ @/tmp/checktoken-body.json -p onehome \ -H 'Origin: https://portal.onehome.com' -H 'Referer: https://portal.onehome.com/' \ | tee /tmp/checktoken.json | jq '{groupID,savedSearchID,agentID,contactID,mlsID,email}' TOKEN="Bearer $(jq -r '.sessionToken' /tmp/checktoken.json)" ``` ### Technical Analysis The Skill writes both authentication stages to fixed paths in a shared temporary directory: - `/tmp/checktoken-body.json` contains the email magic-link token. - `/tmp/checktoken.json` contains the resulting `sessionToken` bearer JWT and associated account scope information. The instructions do not establish a restrictive `umask`, use securely generated temporary paths, validate file ownership, prevent symbolic-link traversal, or delete the files after use. The use of `tee` guarantees that the complete authentication response is persisted even though only selected fields are printed by the following `jq` process. Predictable names in a shared temporary directory create confidentiality and file-clobbering risks. Depending on operating-system protections and the user's existing permissions, another local process may monitor these files, read them, or pre-create a path or symbolic link that redirects output to another user-writable target. ### Attack Path 1. A local attacker predicts the documented `/tmp/checktoken-body.json` and `/tmp/checktoken.json` paths. 2. The attacker monitors those files or, where system protections permit, pre-creates one as a symbolic link or attacker-controlled file. 3. The victim executes the documented magic-link exchange. 4. The email token is written to the first predictable path, and the full A ...[truncated 877 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Avoid writing the bearer token or complete authentication response to disk when it can be processed through an in-memory pipeline. - If temporary storage is unavoidable, create a private temporary directory with `mktemp -d`. - Set `umask 077` before creating files so only the current user receives access. - Create files atomically and do not follow pre-existing symbolic links. - Register a cleanup handler such as `trap 'rm -rf "$tmpdir"' EXIT HUP INT TERM`. - Remove `tee` from the secret-bearing response pipeline unless persistence is explicitly necessary. - Extract only the required fields and redact `sessionToken`, email addresses, and other sensitive response values from terminal output and logs. - Explicitly warn users not to enable shell tracing while handling tokens. - Revoke or refresh the OneHome session if temporary files may have been exposed. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/graphql-operations.md:55
• Finding: Agent Query Collects Unnecessary Personal Data and Reusable Share Tokens<![CDATA[ ## Vulnerability Details **File Location**: `references/graphql-operations.md`, lines 55–91 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```graphql query GetOneHomeUser { user { id firstName lastName email phone registered lastAccessedGroupId lastAccessedSavedSearchId userWelcomed groups { id firstName lastName contactId emails contactStatus createdAt shareToken agent { id firstName lastName fullName email phone officeName officePhone teamName mls { mlsid } } } } } ``` ### Technical Analysis The declared purpose of this query is to resolve a user and their groups so the Skill can determine the relevant group or saved-search scope. However, it requests substantially more information than is required for that purpose, including: - User and agent email addresses and phone numbers - Group contact email addresses and contact status - Office and team details - A `shareToken` - Other account-state fields unrelated to scope resolution The documented output command only consumes group IDs and names. Consequently, the additional fields violate data-minimization and least-privilege principles. The `shareToken` is particularly sensitive because it may function as a reusable capability for accessing a shared portal. Returning it alongside broad personal data increases the consequences of terminal logging, pipeline misuse, or disclosure to downstream tools. ### Attack Path 1. A user with an agent session runs the documented `GetOneHomeUser` operation to identify a group. 2. The API returns all requested fields, including contact data and group share tokens. 3. The unfiltered GraphQL response is processed by shell tooling and may be retained in terminal buffers, command logs, automat ...[truncated 1095 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Replace the broad query with a minimum-field query tailored to scope resolution, for example: ```graphql query GetOneHomeUser { user { lastAccessedGroupId lastAccessedSavedSearchId groups { id firstName lastName } } } ``` Additional hardening should include: - Remove `shareToken`, email addresses, phone numbers, contact status, and unrelated agent metadata from the default operation. - Place any genuinely necessary PII retrieval in a separate, explicitly named operation requiring informed user consent. - Filter sensitive fields before output reaches logs or downstream tools. - Avoid storing raw GraphQL responses. - Redact tokens and contact information in troubleshooting examples. - Document the sensitivity, lifetime, and revocation procedure for share tokens. - Continue preferring the consumer-readable saved-search query when agent-level account enumeration is unnecessary. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The instructions tell the operator how to capture an Authorization bearer from browser traffic and exchange a magic-link token for a reusable session token, but they do not prominently warn that these are sensitive credentials equivalent to account access. This omission makes accidental mishandling, logging, shell-history leakage, or unauthorized reuse more likely, especially because the token grants access to private OneHome data without additional anti-bot controls.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The skill description is broadly framed for querying OneHome data from a shell or script and does not constrain use to the data subject, authorized agents, or a narrowly defined support workflow. In the context of a private real-estate portal accessed via magic links and bearer tokens, this broad invocation surface increases the chance the skill is used to access or automate retrieval of private listing/share data without clear authorization boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly documents two ways to obtain or capture a OneHome bearer token, including harvesting the Authorization header from a live signed-in browser tab. That enables credential extraction and replay against the GraphQL API, which is more sensitive than ordinary data querying because the token can be reused to impersonate the user and access their private portal scope.

Static analysis

No suspicious patterns detected.