Security audit

Kosis Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it can be configured through an undocumented environment variable to send the user's KOSIS API key to a non-KOSIS server.

Install only if you are comfortable providing a KOSIS API key to these scripts. Before use, ensure KOSIS_BASE is unset or exactly the official KOSIS OpenAPI endpoint, and avoid running the skill from wrappers, CI jobs, or shells where environment variables may be controlled by others.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/_common.sh:5
Finding: Environment-Controlled API Base URL Enables Credential Exfiltration
Content: View full analysis
&2; exit 3; } ``` Each command places the API credential in the query string. For example, `scripts/data.sh` contains: ```bash qs="method=getList" qs+="&apiKey=$(urlencode "$KOSIS_API_KEY")" qs+="&orgId=$(urlencode "$org_id")" qs+="&tblId=$(urlencode "$tbl_id")" ``` The bulk endpoint additionally transmits a saved-slice identifier in `scripts/bulk.sh`: ```bash qs="method=getList" qs+="&apiKey=$(urlencode "$KOSIS_API_KEY")" qs+="&userStatsId=$(urlencode "$user_stats_id")" ``` ### Technical Analysis Sending the KOSIS API key to the official KOSIS API is necessary for the declared functionality. However, the shared request helper permits the inherited `KOSIS_BASE` environment variable to replace the official destination without validating its scheme, hostname, port, or path. As a result, all commands trust ambient process configuration to determine where credential-bearing requests are sent. This exceeds the minimum privileges necessary for a KOSIS-only client: production operations require network access to the official KOSIS HTTPS origin, not arbitrary network destinations. Because the API key is included in the URL query string, invocation of any command sends it to the configured destination. Depending on the command, the request can also disclose s ...[truncated 2288 chars]
Remediation: View remediation
&2 exit 2 fi ``` Validation should reject non-HTTPS schemes, user-information components, unexpected ports, alternate hostnames, and hostnames that merely contain `kosis.kr` as a suffix or substring. 3. **Separate test configuration from production credentials.** Never allow a real `KOSIS_API_KEY` to be used with a test or custom endpoint. Require a dedicated test credential and an explicit opt-in flag when using a mock server. 4. **Avoid URL-based credentials where supported.** If the KOSIS API supports an authorization header, transmit the key in that header instead of the query string. If query authentication is mandatory, document the residual exposure and ensure scripts do not enable shell tracing or log complete request URLs. 5. **Apply network egress restrictions.** Where the runtime supports them, restrict this skill to HTTPS connections to `kosis.kr` so that environment manipulation cannot redirect credentials to another origin. 6. **Add regression tests.** Verify that custom schemes, hosts, ports, user-information components, and malformed URLs are rejected before `curl` is invoked. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The example invocation hard-codes a Korean query term (소비자물가지수) and the walkthrough consistently uses Korean dataset labels, which implies a fixed language/locale expectation. The file does not offer an alternative language option or explicit user opt-in for this locale constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The script reads a sensitive credential via KOSIS_API_KEY and appends it to the request query string. While this may be functionally required, the file itself provides no explicit warning, comment, or user-facing notice that a credential will be transmitted to a remote service.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.