Security audit
eho
Security checks for vulnerabilities and agentic risk
Overview
The skill's code and instructions are consistent with its stated purpose (fetching/analyzing Korean apartment transaction data) and it does not request credentials or local access, though it calls a third-party API endpoint rather than directly calling the government API mentioned in the text.
This plugin appears to do what it says: it sends the region, dates, and transaction type to an external API (everyhouse-real-payment.com) and returns the response. Before installing, consider: 1) Privacy: queries may include specific apartment names or addresses — if that’s sensitive for you, avoid sending exact identifiers. 2) Trust the endpoint: the README mentions MOLIT as the data source but the code calls a third-party site that likely aggregates or proxies MOLIT data; verify you trust that site’s data-handling and privacy policy. 3) Inspect updates: the source is listed as “not open yet” in the metadata; prefer plugins with a public repository or npm page you can review and monitor for changes. 4) Test safely: when first using the plugin, run non-sensitive queries to confirm behavior and returned data. If you need stronger assurances, request the plugin author to document the exact data provenance (does the site proxy MOLIT directly, or does it augment/collect additional data?) or publish the source repository for review.
Static analysis
No suspicious patterns detected.
