Security audit
Paragon MLS VB Calc
Security checks for vulnerabilities and agentic risk
Overview
The skill describes a legitimate debt-strategy calculator, but it runs unreviewed external Node/MCP code from a host-specific path and can execute npm build/install scripts outside the packaged skill.
Install only if you trust and can inspect the referenced paragon-mls-mcp project on the host. Review its npm dependencies and build scripts before running the build helper or entering income, expense, debt, HELOC, or other confidential financial details.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.