Security audit

Tmp.FU5tALpYv0

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent, but it teaches scripts to capture and reuse a live OneHome login token to access private real-estate data without enough credential-safety guardrails.

Install only if you are authorized to access the OneHome account/session being queried and you trust the fpx CLI, Transporter extension, and anyone with access to the machine. Treat the bearer token and generated JSON files like account credentials: do not share logs or screenshots containing them, avoid shared machines, clean up temporary files, and prefer a sanctioned API or safer delegated-auth flow where available.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill explicitly instructs users to obtain, handle, and reuse Authorization bearer tokens for a private real-estate portal without prominent warnings that these are sensitive credentials equivalent to account access. Bearer tokens can be replayed by anyone who obtains them, enabling unauthorized access to private listing data and consumer account scope until expiry or revocation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documented workflow writes authenticated GraphQL queries and request bodies to predictable files under /tmp, which is a shared, commonly inspected location on multi-user systems. Even if the token itself is passed by header, the temporary files can still contain sensitive listing IDs, search scopes, group IDs, and other account-linked data, and the pattern encourages unsafe handling without cleanup or restrictive permissions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The file provides ready-to-run authenticated requests using a bearer token and highlights responses containing sessionToken, groupID, savedSearchID, agentID, contactID, mlsID, and email, but gives no credential-handling or privacy warning. In a skill explicitly designed to query a signed-in real-estate portal from shell scripts, this omission increases the chance that users expose tokens in shell history, logs, screenshots, or copied command output and mishandle personal data.

Ssd 3

High

Confidence: 99% confidence
Finding: This section describes using fpx to reach the user's session token itself and then issue authenticated GraphQL calls through that session. That is effectively a session-token interception and replay workflow, which can bypass normal application access boundaries and expose private consumer or agent data to scripts or unauthorized operators.

Ssd 3

High

Confidence: 100% confidence
Finding: The skill gives explicit, step-by-step directions to wait for a signed-in tab to emit a GraphQL request and capture its Authorization header, then reuse that bearer outside the browser. This is dangerous because it operationalizes session hijacking: anyone with access to the paired environment can exfiltrate a live token and impersonate the user to query sensitive OneHome data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.