Paragon MLS Raw Listings

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

The skill’s stated MLS purpose is plausible, but its actual runtime and build behavior depend on unreviewed mutable files outside the package.

Review this before installing unless you also trust and have inspected the external paragon-mls-mcp project at the referenced path. Prefer a package that includes the MCP source, lockfile, and build output or pins the executable with a digest.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:6

Finding

Core MCP Behavior Delegated to an Unreviewed External Executable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6-13
Vulnerability Type: Unreviewed and mutable external component
Risk Level: Suspicious

yaml

metadata:
  openclaw:
    requires:
      bins:
        - node
    mcp:
      paragon-mls:
        command: node
        args:
          - /home/umbrel/.openclaw/workspace/deal-analyst/paragon-mls-mcp/dist/index.js

Technical Analysis

The skill delegates its entire operational behavior to a Node.js executable located outside the audited project. The source code and built artifact for dist/index.js are not included in the supplied package, so the claimed MLS-only behavior cannot be verified.

The absolute path is mutable and has no version or integrity constraint. Anyone able to modify the referenced external file can change the effective behavior of the skill without modifying SKILL.md. This creates a supply-chain trust gap: a legitimate-looking invocation of paragon-mls.raw_listings may execute code that was not reviewed as part of this audit.

Attack Path

1. An attacker compromises the external paragon-mls-mcp project or gains write access to its dist/index.js artifact.
2. The attacker replaces or modifies the external script with unauthorized logic.
3. The agent loads this skill and invokes the trusted paragon-mls MCP tool.
4. Node.js executes the modified external implementation with the permissions and environment available to the MCP process.
5. The substituted implementation can perform actions beyond the documented MLS retrieval operation.

Impact Assessment

Successful exploitation permits arbitrary behavior within the privileges of the account running the MCP process. Depending on the runtime environment, this may include reading accessible local files and environment variables, making network requests, processing or disclosing MLS data, and modifying files writable by that account.

No privilege-escalat ...[truncated 191 chars]

Remediation

View remediation

Remediation Suggestions

• Package the MCP source and build configuration with the skill so its effective behavior can be reviewed.
• Reference a versioned, immutable artifact rather than a mutable absolute filesystem path.
• Verify the executable with a cryptographic hash or signed release before invocation.
• Restrict write access to the installed MCP artifact and its parent directories.
• Run the MCP process under a dedicated least-privileged account or sandbox with only the filesystem and network access required for MLS retrieval.
• Document required credentials, network destinations, and data handling behavior.

T08 · Insecure Dependencies

Note

• Location: scripts/build.sh:3

Finding

Unpinned npm Installation Can Execute Unreviewed Dependency Lifecycle Scripts

Content

View full analysis

Vulnerability Details

File Location: scripts/build.sh, lines 3-5
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: Suspicious

bash

cd /home/umbrel/.openclaw/workspace/deal-analyst/paragon-mls-mcp
npm install
npm run build

Technical Analysis

The build script enters an external project that is absent from the audit scope and runs npm install. The audited package contains no corresponding package.json or lockfile from which dependency versions, package sources, and integrity values can be verified.

npm install may resolve packages dynamically and execute package lifecycle scripts such as preinstall, install, and postinstall. Therefore, a compromised dependency, dependency-confusion package, modified external manifest, or unexpectedly resolved package version could execute arbitrary code during the build. The subsequent npm run build also invokes a script defined by the unaudited external project's manifest.

Attack Path

1. An attacker compromises a dependency, publishes a malicious package version selected by the external manifest, or modifies the external project's manifest or lockfile.
2. A user or automation process executes scripts/build.sh.
3. npm install downloads the attacker-controlled package or uses the modified dependency definition.
4. npm executes a malicious lifecycle script under the builder's account.
5. The malicious code can access resources available to the build process and may alter the generated MCP artifact.
6. Later MCP invocations execute the compromised build output through the path configured in SKILL.md.

Impact Assessment

Exploitation can provide arbitrary code execution with the permissions of the user running the build. The affected scope may include accessible source files, build credentials, environment variables, npm configuration, writable local files, and generated MCP artifacts. A compromised artifact ca ...[truncated 289 chars]

Remediation

View remediation

Remediation Suggestions

• Include the external project's package.json, lockfile, source code, and build scripts within the review scope.
• Commit and review a lockfile, pin exact dependency versions, and retain package integrity hashes.
• Use npm ci instead of npm install for reproducible installation from the reviewed lockfile.
• Use npm ci --ignore-scripts where dependency lifecycle scripts are unnecessary.
• If lifecycle scripts are required, explicitly identify and audit each script before enabling it.
• Configure an approved npm registry and apply package provenance or signature verification where available.
• Execute dependency installation and builds in an isolated, least-privileged environment without production credentials.
• Verify the generated MCP artifact against an expected digest before deployment or execution.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says the skill fetches raw JSON listing payloads from Paragon MLS. The provided code chunk does not implement that behavior; it is only a build helper script that installs dependencies and builds the project. While build scripts can be supporting infrastructure, this chunk itself does not match the declared runtime purpose and shows no evidence of Paragon MLS access or JSON payload retrieval. Therefore this code chunk is materially inconsistent with the stated functionality.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.