Security audit

zillow-fpx

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Zillow helper that can use a signed-in browser session, including saved homes and searches, with no hidden code or deceptive behavior found.

Install only if you are comfortable letting fpx use your open Zillow browser tab. Saved-searches and saved-homes commands can reveal private Zillow account activity in terminal output, command history, files, or automation logs, so avoid running them in shared shells or broad pipelines.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill is designed to route requests through a signed-in browser tab and specifically enables retrieval of saved searches and saved homes tied to the user's Zillow session. While this appears to be the intended functionality, it creates a real privacy and data-exposure risk because any caller using the skill can access account-scoped content without re-authentication if the browser tab is already logged in.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly documents access to saved-searches and saved-homes through the user's signed-in browser tab, but it does not give a clear upfront warning that invoking those flows can expose private Zillow account data to scripts or downstream tooling. That omission increases the chance of unintentional collection or disclosure of sensitive user-specific data because the browser session is being reused as an authentication bridge.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documentation explicitly exposes methods to retrieve signed-in saved searches and saved homes through an ambient authenticated browser session. That extends the skill from public Zillow data retrieval into access to private user-specific data, creating a privacy and consent risk if the skill is invoked without clear user awareness and authorization.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The markdown instructs how to fetch a user's saved searches and favorited homes from authenticated Zillow pages but provides no user-facing warning that these are private account artifacts. In a signed-in browser context, this can silently expose behavioral and preference data that goes beyond ordinary listing lookup and may surprise users or downstream consumers.

Static analysis

No suspicious patterns detected.