Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Paragon MLS

v1.1.2

Fetch real estate listings from Paragon MLS (paragonrels.com / fnimls.com) APIs and perform four-square rental property analysis. Use when: (1) looking up ML...

0· 160·0 current·0 all-time
byEarl Co@earlvanze

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for earlvanze/paragon-mls.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Paragon MLS" (earlvanze/paragon-mls) from ClawHub.
Skill page: https://clawhub.ai/earlvanze/paragon-mls
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install paragon-mls

ClawHub CLI

Package manager switcher

npx clawhub@latest install paragon-mls
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims to provide an MCP server and mcporter-based tools but the package only contains SKILL.md and a small build script; the referenced paragon-mls-mcp directory and dist/index.js are not included. The SKILL.md instructs use of 'mcporter' and 'npm', but required binaries list only includes 'node'. The hard-coded MCP command and example path (/home/umbrel/.openclaw/workspace/...) are specific to the author's machine and are not appropriate for a distributable skill.
!
Instruction Scope
Runtime instructions tell the agent/user to run npm install and mcporter config add and to call Paragon's APIs. They assume presence of a local project tree (paragon-mls-mcp) that isn't bundled. The instructions also note some regions use HTTP (not HTTPS) — a security/privacy concern. The build/run steps give the agent permission to install arbitrary npm packages (supply-chain risk) and to modify mcporter config on the host.
Install Mechanism
There is no formal install spec; this is instruction-only. The included scripts/build.sh runs 'npm install' and 'npm run build' in a server directory, which will fetch dependencies from the npm registry (moderate supply-chain risk). However the server source referenced by these commands is not present in the package, so the instructions are non-functional as distributed.
Credentials
The skill declares no required environment variables or credentials (consistent with its claim of using public Paragon endpoints). That is proportionate. However the SKILL.md and mcp metadata reference a local absolute path for the MCP command; relying on or writing such paths to user config is disproportionate and fragile.
Persistence & Privilege
always:false and user-invocable are set (normal). The skill's recommended steps modify local mcporter configuration (a local client config change), but it does not request persistent or elevated platform privileges.
What to consider before installing
Do not run the build or mcporter commands blindly. Key issues to address before installing: (1) The package does not include the paragon-mls-mcp source or dist/index.js referenced in the docs — ask the publisher where the server code comes from. (2) The SKILL.md assumes 'npm' and 'mcporter' are available but only 'node' is declared; ensure you have the correct tools and review required binaries. (3) Inspect the MCP server source before running 'npm install' to reduce supply-chain risk; consider building in an isolated environment (container/VM). (4) Remove or update the hard-coded path (/home/umbrel/...) so commands do not point to arbitrary user filesystem locations. (5) Note the mention of HTTP endpoints (not HTTPS) — verify network security and privacy implications for any region you query. If the publisher cannot supply the missing server code or justify the hard-coded paths and undeclared dependencies, treat the skill as unreliable and avoid installing it.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binsnode
latestvk97d8yyww09d2emevc7y6w2501857gxy
160downloads
0stars
4versions
Updated 1w ago
v1.1.2
MIT-0

Paragon MLS

Fetch real estate listings from Paragon MLS APIs and analyze rental investment properties.

Quick Start

  1. Build and configure the MCP server once:
cd paragon-mls-mcp && npm install && npm run build
  1. Add to mcporter config (or your MCP client config):
mcporter config add paragon-mls --command "node /home/umbrel/.openclaw/workspace/deal-analyst/paragon-mls-mcp/dist/index.js" --transport stdio
  1. Use the tools:
# Fetch all listings from a shared MLS link
mcporter call paragon-mls.fetch_listings mlsId="6d70b762-36a4-4ac0-bedd-d0dae2920867" systemId="globalmls"

# Fetch a single property by MLS number
mcporter call paragon-mls.fetch_property mlsNumber="201918514" systemId="globalmls"

# Analyze a deal with the spreadsheet-compatible Four-Square model
mcporter call paragon-mls.analyze_deal mlsNumbers="201918514" systemId="globalmls" holdingPeriodYears:5 downPaymentPct:0.25

# Analyze multiple properties with custom assumptions
mcporter call paragon-mls.analyze_deal mlsNumbers="201918514,202012345" systemId="globalmls" downPaymentPct:0.25 interestRate:0.065 monthlyInsurance:250 repairBudget:10000 landValue:35000

# Compare velocity banking strategies for a deal
mcporter call paragon-mls.vb_calc debtBalance:350000 interestRate:0.05 loanTermYears:30 monthlyIncome:8000 monthlyExpenses:4878.875681 extraPayment:1000

# Get raw JSON data
mcporter call paragon-mls.raw_listings mlsNumbers="201918514" systemId="globalmls"

Tools

fetch_listings

Fetch all property listings from a Paragon MLS listing GUID. Returns parsed property data for all active listings.

  • mlsId (required): Paragon MLS listing GUID from the URL
  • systemId (default: globalmls): MLS region ID (subdomain of paragonrels.com)

fetch_property

Fetch a single property by its MLS number. Returns structured property data.

  • mlsNumber (required): MLS number for the property
  • systemId (default: globalmls): MLS region ID
  • mlsId (optional): Listing GUID for link generation

analyze_deal

Perform a spreadsheet-compatible Four-Square analysis on one or more properties. Returns the major columns from the Google Sheet, including NOI, DSCR, principal paydown, appreciation, depreciation, ROI, ROE, and IRR.

Key inputs:

  • mlsNumbers (required): Comma-separated MLS numbers
  • systemId (default: globalmls): MLS region ID
  • holdingPeriodYears (default: 5)
  • offerPricePct (default: 1)
  • downPaymentPct (default: 0.20)
  • interestRate (default: 0.07)
  • loanTermYears (default: 30)
  • vacancyRate / repairsPct / capexPct / mgmtPct for recurring expense assumptions
  • closingCosts / repairBudget / reservePrepaid / privateMoneyLender / landValue for capital stack and tax assumptions
  • monthlyPropertyTaxes / monthlySchoolTaxes / monthlyInsurance / monthlyWater / monthlySewer / monthlyGarbage / monthlyElectric / monthlyGas / monthlyHoa / monthlyLawnSnow / monthlyLegalAccounting for direct spreadsheet column overrides
  • unitRent1..unitRent7 / laundryIncome / storageIncome / miscIncome for income overrides

vb_calc

Compare amortized debt, extra payments, chunking/basic acceleration, and advanced velocity banking.

  • debtBalance (required)
  • interestRate (required)
  • loanTermYears (default: 30)
  • extraPayment (default: 0)
  • monthlyIncome (required)
  • monthlyExpenses (required)
  • helocRate (default: 0.2399)
  • advancedRate (default: 0.08)
  • helocLimit (default: 20000)
  • chunkMonths (default: 6)

raw_listings

Fetch raw JSON data from the Paragon API for custom analysis. Returns unprocessed listing data.

  • mlsNumbers (required): Comma-separated MLS numbers
  • systemId (default: globalmls): MLS region ID

System IDs

Common Paragon MLS system IDs (the subdomain before .paragonrels.com):

RegionSystem ID
Eastern NY / Southern Adirondackglobalmls
InterMountain (Idaho)imls
SW Coloradocren
Hudson County, NJhudson
Georgiagamls
Triangle Region, NCtriangle

Check your local MLS website URL to find the correct system ID.

How It Works

The server calls Paragon's public CollabLink API endpoints:

  1. CreateGuid — generates a session GUID for API calls
  2. GetNotificationAppData — resolves a listing GUID into MLS numbers
  3. GetListingDetails — fetches property data for each MLS number

Property data is parsed from Paragon's nested JSON structure, handling both the "new" format (section-based DetailOptions) and "old" format (array-based).

Limitations

  • Paragon's API is public but unofficial; it may change without notice
  • Each MLS region may format listing data differently; the parser handles common formats but edge cases may require custom handling
  • No authentication is required for public listing data
  • The API returns data over HTTP (not HTTPS) for some regions
  • Rate limiting may apply; the server processes listings sequentially with no intentional delay

Comments

Loading comments...