Security audit
Paragon MLS VB Calc
Security checks across malware telemetry and agentic risk
Overview
The skill describes a legitimate debt-strategy calculator, but it runs unreviewed external Node/MCP code from a host-specific path and can execute npm build/install scripts outside the packaged skill.
Install only if you trust and can inspect the referenced paragon-mls-mcp project on the host. Review its npm dependencies and build scripts before running the build helper or entering income, expense, debt, HELOC, or other confidential financial details.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
66/66 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.