Paragon MLS Fetch Property

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:51 AM UTC
• Version: 1.0.0

Overview

This skill appears intended to fetch MLS listing data, but it depends on unreviewed code at a hardcoded local path and includes a build script that runs npm commands outside the reviewed package.

Review this before installing. Only use it if you trust the external paragon-mls-mcp project at the hardcoded path and have audited its package.json, lockfile, dependencies, build scripts, and generated dist/index.js. Prefer a version that includes the MCP source and lockfile inside the reviewed package or pins the external implementation to a verifiable revision.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/build.sh:3

Finding

Unreviewed External npm Installation and Script Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/build.sh, lines 3–5
Vulnerability Type: Insecure third-party dependency and build-script execution
Risk Level: Medium

bash

cd /home/umbrel/.openclaw/workspace/deal-analyst/paragon-mls-mcp
npm install
npm run build

Technical Analysis

The build script changes into an external project directory that is not part of the audited artifact and runs npm install. This command may retrieve third-party packages and execute npm lifecycle hooks with the invoking user's privileges. It then executes npm run build, whose command is defined by an external package.json that was unavailable for review.

Consequently, the audited package does not provide enough information to verify the installed package names, versions, integrity constraints, lifecycle behavior, or build command. If the external dependency manifest, lockfile, registry-resolved package, or lifecycle script is compromised, arbitrary commands can run during the build.

The same unreviewed external project is referenced by SKILL.md lines 12–14 as the MCP server implementation:

yaml

command: node
args:
  - /home/umbrel/.openclaw/workspace/deal-analyst/paragon-mls-mcp/dist/index.js

This supporting observation means the runtime implementation and its network or data-handling behavior could not be verified from the artifact. It does not independently establish malicious behavior.

Attack Path

1. An attacker compromises an npm dependency resolved by the external project, or modifies its package.json, lockfile, lifecycle scripts, or build script.
2. A user or agent invokes scripts/build.sh.
3. The script enters the external project directory without validating its provenance or contents.
4. npm install downloads dependencies and may execute attacker-controlled lifecycle hooks.
5. npm run build executes the externally defined build command.
6. The attacker's commands run w ...[truncated 564 chars]

Remediation

View remediation

Remediation Suggestions

• Include the required source, package.json, and lockfile within the reviewed project boundary, or otherwise pin the external project's exact trusted revision.
• Replace npm install with npm ci and require a committed, reviewed lockfile to ensure reproducible dependency resolution.
• Use npm ci --ignore-scripts when lifecycle scripts are unnecessary.
• If lifecycle scripts are required, audit and explicitly allow only the necessary scripts and dependencies.
• Pin dependencies to reviewed versions and verify package integrity and registry provenance.
• Avoid a hardcoded absolute path to an unreviewed mutable workspace. Resolve a validated project-relative location or verify the external directory and files cryptographically before use.
• Audit the externally defined build command and generated dist/index.js before executing them.
• Run dependency installation and builds in a sandbox or container with minimal filesystem access, no unnecessary credentials, restricted network access, and a non-privileged account.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill retrieves a single Paragon MLS property by MLS number and system ID and returns parsed listing details. However, the supplied code does not implement any property lookup or MLS access. It only performs development/build steps: entering a directory, running npm install, and npm run build. That is a materially different purpose from the declared behavior, so this is a clear mismatch.

Content

No source excerpt is available for this finding.