Hauscout

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:54 AM UTC
• Version: 1.0.0

Overview

The skill fits its real-estate collection purpose, but it should be reviewed because it tells an agent to run unaudited local code, write persistent data, and push Git changes without clear confirmation controls.

Install only if you control /Users/kendrick/projects/hauscout and understand that running the skill can scrape HouseSigma, call AI services, write or update Neon database records, create local memory summaries, and publish repository changes. Prefer dry-run first, use scoped DATABASE_URL credentials, verify dependencies from a lockfile, inspect scripts/collect.ts, review git status and diffs, and approve any push manually.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 12-15; a second occurrence appears at lines 36-46 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash cd /Users/kendrick/projects/hauscout npx tsx scripts/collect.ts ``` The database inspection instructions similarly invoke the package without an explicit version: ```bash cd /Users/kendrick/projects/hauscout npx tsx -e " import { neon } from '@neondatabase/serverless'; import { drizzle } from 'drizzle-orm/neon-http'; import * as schema from './src/db/schema'; // .env.local 로드 필요 const sql = neon(process.env.DATABASE_URL!); const db = drizzle(sql, { schema }); const all = await db.select().from(schema.listings); console.log(JSON.stringify(all, null, 2)); " ``` ### Technical Analysis The Skill invokes `tsx` through `npx` without specifying an exact version or requiring a verified, locally installed dependency. If a suitable local executable is unavailable, `npx` may resolve and download a package from the configured npm registry. The resulting executable is then run with the current user's permissions. The command also executes `scripts/collect.ts` from the external absolute directory `/Users/kendrick/projects/hauscout`. That script and its dependency metadata were not included in the audited artifact, so their integrity and behavior cannot be verified from this project. This creates a supply-chain boundary in which execution may depend on mutable registry content, local npm configuration, dependency resolution, and an unaudited external project directory. ### Attack Path 1. An attacker compromises or influences the npm registry, configured registry mirror, package-resolution configuration, or the relevant package distribution. 2. Alternatively, an attacker with access to the external project modifies its dependency configuration or `scripts/collect.ts`. 3. The agent follow ...[truncated 975 chars]
• Remediation: ## Remediation Suggestions 1. Declare `tsx` as a project dependency at an exact, reviewed version and commit the package manifest and lockfile. 2. Install dependencies using a lockfile-enforcing command such as `npm ci` rather than permitting ad hoc package resolution. 3. Invoke the verified local executable through a package script, for example `npm run collect`, instead of relying on an unversioned `npx` command. 4. Consider using `npx --no-install tsx ...` if `npx` remains necessary, so execution fails rather than downloading a missing package. 5. Verify package integrity and provenance, use a trusted registry, and protect npm configuration from unauthorized modification. 6. Include the referenced collection script, dependency manifests, and relevant source files within the auditable project boundary. 7. Run the collector with a least-privileged account and provide only the environment variables and filesystem access required for the task. 8. Replace the inline database command with a reviewed, version-controlled diagnostic script that limits output to necessary records and fields.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31
• Finding: Unrestricted Git Commit and Push Instruction## Vulnerability Details **File Location**: `SKILL.md`, line 31 **Vulnerability Type**: Unsafe repository publication workflow **Risk Level**: Medium ### Vulnerable Code ```text 5. git commit & push (변경사항 있을 때만) ``` ### Technical Analysis The Skill instructs the agent to commit and push whenever changes exist, but it does not require inspection of the working tree, review of the staged diff, validation of the configured remote, secret scanning, file allowlisting, or explicit user approval. Although the instruction does not specify an unsafe staging command itself, an automated agent may interpret it broadly and stage all repository changes. Collection output, persistent memory summaries, unrelated user modifications, generated files, or accidentally created credentials could consequently be included in a commit and transmitted to the configured Git remote. ### Attack Path 1. The collection process, another local process, or an attacker with repository write access creates or modifies files in `/Users/kendrick/projects/hauscout`. 2. The changes include sensitive data, unrelated work, manipulated generated content, or credential-bearing files. 3. The agent follows the checklist without first reviewing `git status`, the complete diff, and the destination remote. 4. The agent stages the affected files, creates a commit, and pushes it. 5. Anyone with access to the remote repository can retrieve the published content. If the remote or branch is attacker-controlled, the attacker receives it directly. ### Impact Assessment Exploitation can cause unauthorized disclosure of any repository content that the agent stages and commits, including operational records, collected property data, persistent memory notes, unrelated source changes, or secrets accidentally written into the working tree. The instruction does not itself grant new operating-system privileges. Its direct scope is the repository and any Git remote for whic ...[truncated 150 chars]
• Remediation: ## Remediation Suggestions 1. Do not make pushing a default post-collection action. Require explicit user authorization immediately before any remote write. 2. Require the agent to run and present `git status --short`, inspect the complete staged and unstaged diff, and verify the intended branch. 3. Verify the destination with `git remote -v` and confirm that the remote repository and branch are authorized. 4. Stage only an explicit allowlist of expected files. Prohibit blanket staging commands such as `git add .` and `git add -A`. 5. Run secret scanning and inspect generated files for credentials, connection strings, personal data, and unexpected collection output before committing. 6. Ensure `.env*`, credential files, database exports, browser profiles, and sensitive memory files are excluded through repository policy and `.gitignore`. 7. Use a narrowly scoped Git credential that can write only to the intended repository and protected branch workflow. 8. Separate commit creation from push authorization so a reviewed local commit can be created without automatically publishing it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Credential Access

High

• Category: Privilege Escalation

Content

import { neon } from '@neondatabase/serverless';
import { drizzle } from 'drizzle-orm/neon-http';
import * as schema from './src/db/schema';
// .env.local 로드 필요
const sql = neon(process.env.DATABASE_URL!);
const db = drizzle(sql, { schema });
const all = await db.select().from(schema.listings);

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill description explicitly says it will collect external real-estate data, perform AI analysis, and store results in Neon PostgreSQL, but it does not warn the user that network access and persistent database writes will occur. In an agent setting, missing disclosure can lead to unintended outbound traffic, site scraping, and state-changing operations without informed consent.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill instructs running `npx tsx` without pinning an exact package version, which can cause execution of whatever version is currently resolved from the registry or local environment. In an agent-executed skill, this introduces supply-chain risk because a compromised or incompatible package version could run arbitrary code during collection.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: This command again uses `npx tsx` without an exact pinned version for an inline script that accesses the database. That creates avoidable supply-chain and reproducibility risk, especially because the command can touch sensitive data and environment-provided credentials.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The natural-language description and trigger phrases are entirely in Korean, and the file does not indicate that language selection is optional or that the skill is intentionally limited to Korean-speaking users. Under the stated policy, forcing a specific language without opt-in can be a language/locale policy violation.

Static analysis

No suspicious patterns detected.