Housesigma Collector

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:53 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for collecting HouseSigma property data, but it directs automated database writes and git pushes with limited safety guidance.

Review this skill before installing if the Hauscout database contains private, licensed, proprietary, or personal data. Use a pinned local tsx dependency or npm script, confirm the target database path, keep backups, validate collected fields before writes, and do not enable cron or git push unless you are comfortable publishing the database to the configured remote repository.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned npx Package Execution May Introduce Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-29
Vulnerability Type: Unpinned third-party package execution through npx
Risk Level: Medium

Vulnerable Code

bash

cd /Users/kendrick/projects/hauscout && npx tsx scripts/collect.ts

bash

cd /Users/kendrick/projects/hauscout && npx tsx scripts/collect.ts --url "<housesigma_url>"

bash

cd /Users/kendrick/projects/hauscout && npx tsx scripts/collect.ts --profile <id>

bash

cd /Users/kendrick/projects/hauscout && npx tsx scripts/collect.ts --headed

Technical Analysis

The documented commands execute tsx through npx without specifying a package version or using --no-install. If a trusted, locally installed tsx binary is unavailable, npx may resolve, download, and execute package content from the configured package registry.

The referenced Hauscout project and its dependency metadata are outside the audited artifact, which contains only SKILL.md. Consequently, the audit could not verify that tsx is pinned by a lockfile, installed from a trusted registry, or protected by integrity controls. Package initialization or runtime code executes with the privileges of the user running the Skill.

This is a supply-chain weakness rather than evidence that the current tsx package is malicious. Exploitation requires the resolved dependency or configured registry to be compromised, substituted, or otherwise attacker-controlled.

Attack Path

1. An agent or user follows one of the documented collection commands.
2. npx searches for a locally installed tsx executable.
3. If the executable is unavailable, npx resolves the unpinned package through the configured registry.
4. An attacker who has compromised the package, registry, dependency-resolution path, or local package configuration supplies malicious package content.
5. npx downloads and executes ...[truncated 984 chars]

Remediation

View remediation

Remediation Suggestions

1. Add tsx as an explicit development dependency in the Hauscout project and pin it through a committed lockfile.
2. Install dependencies using a lockfile-enforcing command such as:

   bash

   npm ci
   

3. Prevent npx from downloading missing packages at execution time:

   bash

   npx --no-install tsx scripts/collect.ts
   

4. Prefer a lockfile-backed package script, for example:

   json

   {
     "scripts": {
       "collect": "tsx scripts/collect.ts"
     }
   }
   

   Then invoke it with:

   bash

   npm run collect
   

5. Configure an approved package registry and retain package-integrity metadata in the lockfile.
6. Run dependency auditing and update review processes before accepting new versions.
7. Execute collection under a least-privileged account with only the filesystem, database, network, and repository permissions required for the task.
8. Avoid exposing unrelated secrets or broadly privileged Git credentials to the collection process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The skill instructs use of npx tsx without pinning an exact package version, which can cause execution of whatever version resolves at runtime. In a security-sensitive automation context, this creates supply-chain risk because a compromised or incompatible upstream package could be fetched and executed unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

This invocation again relies on unpinned npx tsx, which may download and execute a non-deterministic package version at runtime. If the package registry or dependency chain is compromised, the collector workflow could execute attacker-controlled code on the local machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

Using npx tsx without version pinning introduces a repeatable supply-chain exposure wherever users follow the command. Because this skill is intended to access local project data and databases, arbitrary code execution through a poisoned package would have meaningful local impact.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The same unpinned npx tsx pattern appears in the headed debugging command, preserving the same risk of executing an unexpected package version. Since this is presented as normal usage, users may run it directly without realizing they are trusting live package resolution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs direct SQLite insertion and automated database updates without warning the operator that local persistent data will be modified. In agent or semi-automated use, this can lead to unintended corruption, overwrites, or insertion of malformed/sensitive data into the local project database.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs users to git add, commit, and push the database file, which can upload collected data to a remote repository without any warning about data sensitivity or repository visibility. If the database contains proprietary, licensed, personal, or otherwise sensitive scraped data, this could cause unintended disclosure and downstream compliance issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The operational instructions are entirely presented in Korean, which can function as an implicit language requirement for users of the skill. Under the policy, language constraints should either provide user choice or be explicitly justified as region- or audience-specific.

Content

No source excerpt is available for this finding.