Kamis Cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:07 AM UTC
• Version: 0.1.0

Overview

This KAMIS price CLI mostly matches its stated purpose, but it needs review because an undocumented endpoint override can send configured API credentials to an arbitrary URL.

Review before installing if you plan to use real KAMIS credentials. Only run it in a trusted shell environment, leave KAMIS_BASE unset unless you deliberately control the endpoint, avoid shell tracing or logging full command lines, and rotate the KAMIS key if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_common.sh:19

Finding

API Credentials Exposed Through Request URLs and Process Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/_common.sh, lines 19–26
Vulnerability Type: API credential exposure
Risk Level: Medium

Vulnerable Code

bash

local key="${KAMIS_CERT_KEY:-TEST}"
local id="${KAMIS_CERT_ID:-TEST}"
local url="${KAMIS_BASE}?action=${action}&p_cert_key=${key}&p_cert_id=${id}&p_returntype=json"
for arg in "$@"; do url+="&${arg}"; done
curl -sS --max-time 30 \
  -H "User-Agent: Mozilla/5.0 (kamis-cli)" \
  -H "Accept: application/json" \
  "$url"

Technical Analysis

The helper embeds KAMIS_CERT_KEY and KAMIS_CERT_ID directly into the request URL and then supplies that URL as a curl command-line argument. When real credentials replace the default TEST values, they may be visible through local process inspection while the request is active.

Query-string credentials can also be retained by endpoint access logs, HTTP proxies, debugging output, monitoring products, or shell tracing. TLS protects the request in transit but does not prevent credential disclosure through local process metadata or URL logging at either endpoint.

Attack Path

1. A victim exports valid KAMIS_CERT_KEY and KAMIS_CERT_ID values.
2. The victim runs any network-backed command such as scripts/daily.sh.
3. kamis_call creates a URL containing both credentials.
4. The complete URL is passed to curl as a process argument.
5. A local user with sufficient process-inspection access, or a monitoring/logging component, captures the URL.
6. The captured credentials are reused against the KAMIS API.

Impact Assessment

An attacker may obtain the victim's KAMIS API identity and key, make requests under that account, consume its API quota, and access any API functionality authorized to those credentials. This does not directly grant operating-system privileges, and exploitation through process inspection generally requires local access or access to relevant logs.

Remediation

View remediation

Remediation Suggestions

• Use an authorization header or request body for credentials if the KAMIS API supports either mechanism.
• If query-string authentication is mandatory, avoid passing the complete authenticated URL directly as a command-line argument. Use a protected curl configuration or input mechanism where practical.
• Ensure shell tracing is disabled around authenticated requests.
• Configure application, proxy, and monitoring logs to redact p_cert_key and p_cert_id.
• Document that KAMIS query-string authentication may expose credentials in server-side URL logs.
• Use narrowly scoped credentials and rotate any credentials suspected of being recorded or disclosed.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_common.sh:5

Finding

Unrestricted Endpoint Override Can Redirect API Credentials

Content

View full analysis

Vulnerability Details

File Location: scripts/_common.sh, lines 5 and 19–26
Vulnerability Type: Credential exfiltration through unvalidated endpoint configuration
Risk Level: Medium

Vulnerable Code

bash

KAMIS_BASE="${KAMIS_BASE:-https://www.kamis.or.kr/service/price/xml.do}"

bash

local key="${KAMIS_CERT_KEY:-TEST}"
local id="${KAMIS_CERT_ID:-TEST}"
local url="${KAMIS_BASE}?action=${action}&p_cert_key=${key}&p_cert_id=${id}&p_returntype=json"
for arg in "$@"; do url+="&${arg}"; done
curl -sS --max-time 30 \
  -H "User-Agent: Mozilla/5.0 (kamis-cli)" \
  -H "Accept: application/json" \
  "$url"

Technical Analysis

KAMIS_BASE may be replaced by an arbitrary environment variable without validation of its scheme, hostname, port, or path. The helper then appends the API key and user ID to that destination.

This is especially dangerous in inherited shell environments, CI jobs, wrapper scripts, scheduled automation, or shared configuration where an attacker can influence environment variables. The use of HTTPS by the legitimate default does not protect credentials when the configured destination itself is attacker-controlled.

No redirect-following option is present, which limits redirect-based exploitation, but direct endpoint substitution remains possible.

Attack Path

1. An attacker gains the ability to influence the victim process environment or automation configuration.
2. The attacker sets KAMIS_BASE to an attacker-controlled URL.
3. The victim retains valid KAMIS_CERT_KEY and KAMIS_CERT_ID environment variables.
4. The victim invokes a network-backed script such as daily.sh, monthly.sh, or period.sh.
5. kamis_call appends the credentials and request parameters to the attacker-controlled base URL.
6. curl sends the authenticated request directly to the attacker's server.
7. The attacker records and reuses the disclosed credentials.

Impact Assessment

The attacker can obtain the configured KAMI ...[truncated 304 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the production endpoint override if custom endpoints are unnecessary.
• Otherwise, parse and validate the endpoint before attaching credentials.
• Require the exact https scheme, www.kamis.or.kr hostname, expected port, and /service/price/xml.do path.
• Reject embedded user information, fragments, unexpected ports, malformed URLs, and non-HTTPS destinations.
• Permit custom endpoints only behind an explicit development or testing option that does not use production credentials.
• Clear or reject real credentials when a non-production endpoint is selected.
• Keep redirect following disabled for authenticated requests, or independently validate every redirect destination before forwarding credentials.
• In CI and scheduled environments, define a minimal trusted environment rather than inheriting arbitrary variables.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill exposes shell-based scripts but does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization ambiguity: an agent may invoke shell capabilities more broadly than intended, increasing the chance of unsafe command execution or misuse in environments where tool access should be tightly constrained.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description says to use the skill when the user asks about "Korean food/produce prices, market prices, agri price trends, restaurant ingredient costs" without clearly constraining that this refers specifically to KAMIS Korean agricultural price data. These phrases are broad enough to match everyday requests that might concern non-Korean markets, general budgeting, or restaurant costs outside the skill's intended scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Multiple user-facing strings are fixed in Korean, and the script provides no option for language selection or explanation that it is intentionally Korean-only. This can violate language/locale policy when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Comments, labels, and emitted output are all fixed in Korean, and there is no indication that the user can opt into another language or that the skill is intentionally restricted to a Korean-speaking context. The policy requires avoiding forced language/locale behavior unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The helper builds a URL containing p_cert_key and p_cert_id from environment variables and sends it via curl to a remote service. There is no confirmation prompt, visible logging/print statement, or warning comment/docstring in the function indicating that credential-related values will be transmitted over the network.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language description and examples presented by the script are written in Korean only, which can constitute a language policy violation when no user language choice or opt-in is offered. Nothing in this file indicates that the skill is intentionally region-specific or that Korean is a documented requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README mixes Korean heavily in the skill description, examples, and usage context, and does not indicate that output or interaction language is optional or user-selectable. Under the policy rule for language/locale, this can be read as a default language constraint without explicit opt-in, even though the tool may be useful to non-Korean-speaking users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This shell script invokes a helper script that appears to call the KAMIS monthly endpoint and even mentions an API key in the fallback message. While the network access is likely part of the script's purpose, there is no explicit user-facing warning that running it will contact external services and may use configured API credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script invokes another helper to fetch market data and suppresses stderr, but this file does not include any user-facing notice that it performs external data retrieval. For code files, network/data-transmission behavior should have some visible disclosure such as a comment, log, or prompt unless clearly communicated elsewhere in the skill description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file uses Korean-only values for most displayed names, and the note on L96 references KAMIS-specific canonical lookup without stating that this dataset is intentionally Korea-specific. Because SQP-3 applies to all file types, this can be treated as a locale constraint embedded in natural-language/content without explicit user choice or documented justification in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file includes user-facing usage descriptions entirely or partially in Korean for category meanings and labels, such as '부류', '품목', '시도', and '등급'. This imposes a specific language/locale in the interface text without any opt-in, fallback, or indication that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script's user-facing header comments and help output are written in Korean, and the help path prints these comments directly via sed -n '2,11p'. This imposes a specific language for users without offering a language choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script invokes kamis_call to query an external service, which is a network operation, but there is no visible confirmation prompt, logging, or explanatory comment near the call indicating that request data will be transmitted. In this file, the only comments describe arguments and purpose, not that an external API request is made.

Content

No source excerpt is available for this finding.