Ncloud Maps

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:44 PM UTC
• Version: 1.0.8

Overview

This is a coherent Naver Cloud Maps routing skill with expected use of Naver API keys and route coordinates, but users should review privacy and dependency notes before installing.

Install only if you are comfortable sending route coordinates, waypoints, and Naver API-authenticated requests to Naver Cloud Maps. Keep the API key scoped to Maps/Directions, avoid sensitive personal routes when unnecessary, and update/audit npm dependencies before production use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (68)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code is clearly related to Naver Cloud Maps route navigation, so the general domain matches. However, the declared description makes a specific behavioral claim: default to Directions5 and automatically switch to Directions15 when there are 5 or more waypoints. This code chunk contains only a Directions15 client, with no logic to select between APIs based on waypoint count. That is a material description-to-behavior mismatch because the primary routing strategy described is not implemented in the supplied code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The core behavior shown is route querying against Naver Cloud Maps Directions5, which aligns broadly with route navigation. However, the declared description specifically promises smart routing behavior: using Directions5 by default and auto-switching to Directions15 when there are 5 or more waypoints. This code does not implement any such switching. Instead, it hard-limits waypoints to 5 and returns an error when more than 5 are provided. So the description overstates the implemented capability in a material way.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code does match the general theme of querying Naver Cloud Maps for route navigation, but it does not accurately implement the specific declared behavior. The code only calls the Directions15 endpoint (map-direction-15/v1/driving) and contains no logic to select Directions5 by default or switch APIs when waypoint count reaches 5 or more. This is a material description-to-behavior mismatch because the declared smart routing behavior is absent. There are no obvious unrelated capabilities beyond route lookup and input validation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code does match the general domain of querying Naver Cloud Maps for route navigation, but it does not implement the key advertised behavior: 'smart routing' with automatic switching to Directions15 for 5+ waypoints. Instead, this chunk is explicitly limited to Directions5 and returns an error when more than 5 waypoints are supplied. There are no undeclared harmful capabilities or unrelated resource accesses visible in this chunk; the mismatch is that the declared behavior overstates functionality compared with the actual implementation.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 174)May include surrounding context.

• Obtain Client ID (API Key ID) and Client Secret (API Key)
  • Enable "Maps Directions15" API

2. Set environment variables (or use .env file):

bash

export NCLOUD_API_KEY_ID="your-api-key-id"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 210)May include surrounding context.

• Obtain Client ID (API Key ID) and Client Secret (API Key)
  • Enable "Maps Directions15" API

2. Set environment variables (or use .env file):

bash

export NCLOUD_API_KEY_ID="your-api-key-id"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 212)May include surrounding context.

• Obtain Client ID (API Key ID) and Client Secret (API Key)
  • Enable "Maps Directions15" API

2. Set environment variables (or use .env file):

bash

export NCLOUD_API_KEY_ID="your-api-key-id"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

• Obtain Client ID (API Key ID) and Client Secret (API Key)
  • Enable "Maps Directions15" API

2. Set environment variables (or use .env file):

bash

export NCLOUD_API_KEY_ID="your-api-key-id"

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The lockfile pins axios 1.13.5, and the supplied advisory set includes multiple high-risk issues such as SSRF-related proxy bypass and prototype-pollution-assisted request/response tampering. In a maps skill that makes outbound API calls, an HTTP client flaw is directly relevant because it can affect routing requests, credential handling, and trust boundaries around remote responses.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names/filenames. While this maps skill may be less likely to construct multipart requests in normal operation, the vulnerable package is present as a transitive dependency and could become exploitable if any feature or future code path submits attacker-influenced multipart data.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The package allows installation of axios 1.13.5, which the finding reports as having multiple known advisories including SSRF and MITM-related issues. In a maps-routing skill that makes outbound API requests, a vulnerable HTTP client is especially relevant because it processes network destinations, proxy settings, and remote responses, increasing the chance that misrouting, credential leakage, or request/response manipulation could affect the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README clearly instructs users to submit precise start, goal, and waypoint coordinates to Naver Cloud Maps, but it does not provide an explicit privacy or data-sharing warning. Route and location data can reveal sensitive movement patterns, home/work locations, and travel behavior, so omission of disclosure increases privacy risk for unsuspecting users.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 241)May include surrounding context.

md

## Resources

- [Naver Cloud Console](https://console.ncloud.com)
- [Maps Directions API Docs](https://api.ncloud-docs.com/docs/ko/application-maps-directions)
- [OpenClaw Docs](https://docs.openclaw.ai)
- [ClawHub](https://clawhub.com)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents use of environment credentials (NCLOUD_API_KEY_ID, NCLOUD_API_KEY) but does not declare any explicit tool scope or permissions boundary. In an agent setting, missing scope declarations can cause overbroad access to environment data and make secret handling less auditable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill asks users for addresses or coordinates and describes optional upstream geocoding, but it does not clearly warn that sensitive location data will be transmitted to Naver Cloud and possibly third-party geocoding providers. In a mapping context, location data can reveal home/work patterns or other personal information, so lack of disclosure increases privacy risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

export NCLOUD_API_KEY="your-api-key-secret"

text

Or create a `.env` file:

NCLOUD_API_KEY_ID=your-api-key-id NCLOUD_API_KEY=your-api-key-secret

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Multiple user-visible strings in this file, including error messages and status logs, are written only in Korean. This can violate language/locale policy when the skill does not offer user opt-in for Korean or explain that the skill is intentionally limited to a Korean-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code reads API credentials from parameters and sends them as request headers to an external service via axios. Although the network call is part of the routing function, the file provides no user-facing warning, confirmation, or explicit disclosure that supplied credentials and route data will be transmitted to a third-party API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code loads NCLOUD API credentials from environment variables and later invokes remote directions APIs using start, goal, and waypoint parameters. While the header documents required environment variables, it does not clearly warn users that their route/location data will be sent to an external cloud service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code contains natural-language comments, logs, and error messages in Korean, including user-facing validation and API error responses. Because the skill does not offer a language/locale choice or clearly document that it is intentionally Korean-only, it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code sends the user's start, goal, and optional waypoint coordinates to a third-party HTTP endpoint. While the function logs progress, it does not provide any user-facing disclosure or warning that location data will be transmitted off-system, which is a privacy-relevant operation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.