Paragon MLS Analyze Deal

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:50 AM UTC
• Version: 1.0.0

Overview

This skill is framed as real-estate deal analysis, but its actual MCP code is an unreviewed Node project at an absolute external path that can be installed, built, and run outside the skill package.

Install only if you already trust and can audit the external paragon-mls-mcp project at that path. Prefer a packaged or pinned implementation with a lockfile, reviewed dependencies, and a restricted runtime before exposing MLS data, local files, credentials, or business-sensitive underwriting inputs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/build.sh:3

Finding

Unverified External Project and Unsafe npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: scripts/build.sh:3-5 and SKILL.md:8-13
Vulnerability Type: Supply-chain execution through an unaudited external project
Risk Level: Medium

Vulnerable Code

scripts/build.sh:3-5:

bash

cd /home/umbrel/.openclaw/workspace/deal-analyst/paragon-mls-mcp
npm install
npm run build

Related MCP configuration in SKILL.md:8-13:

yaml

mcp:
  paragon-mls:
    command: node
    args:
      - /home/umbrel/.openclaw/workspace/deal-analyst/paragon-mls-mcp/dist/index.js

Technical Analysis

The build script changes into a fixed directory outside the audited project and runs npm install followed by an externally defined npm build script. The external project's package manifest, lockfile, dependency sources, lifecycle scripts, source code, and build command are not included in the audited package.

By default, npm install can execute dependency lifecycle hooks such as preinstall, install, and postinstall. The subsequent npm run build executes whatever command the external project's package manifest defines. The resulting dist/index.js is then launched as the MCP server according to SKILL.md.

This creates an unverified supply-chain boundary: the effective executable behavior can change when the external directory, package metadata, dependency resolution, or generated build artifact changes, without any modification to this Skill.

Attack Path

1. An attacker compromises or replaces the external paragon-mls-mcp project, its package metadata, or one of its resolved npm dependencies.
2. The attacker adds malicious behavior to an npm lifecycle hook, the build script, application source code, or a dependency.
3. A user or automation process invokes scripts/build.sh.
4. npm install executes the compromised lifecycle code, or npm run build executes the malicious build command.
5. The generated `/home/umbrel/.openclaw/work ...[truncated 862 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the MCP implementation, package.json, and dependency lockfile within the reviewed and version-controlled project, or pin the external project to a verified immutable revision.
2. Replace npm install with npm ci so installation strictly follows a committed lockfile.
3. Use npm ci --ignore-scripts when dependency lifecycle scripts are not required. If scripts are necessary, audit and explicitly allow only the required scripts.
4. Pin dependency versions and integrity hashes, review transitive dependencies, and use automated dependency and provenance scanning.
5. Avoid relying on a mutable absolute path outside the Skill package. Resolve the executable from a controlled, validated installation directory.
6. Verify the integrity or signature of the external project and generated dist/index.js before execution.
7. Run installation, compilation, and the MCP server in a restricted environment with minimal filesystem, credential, and network access.
8. Document the external trust boundary and ensure changes to the MCP implementation receive the same security review as changes to the Skill.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose describes a real-estate rental analysis capability, but the provided code chunk does not implement any financial calculations or spreadsheet interaction. It only performs project setup/build actions by entering a repository directory, installing dependencies, and invoking the build. That is a materially different primary purpose from the declared analytical function, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.