ClawHub
Back to skill

Security audit

NTS BizNo CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Korean business-number verification CLI, but it needs review because it can send API keys and business/KYB data to an environment-controlled endpoint.

Install only if you are comfortable sending Korean business registration numbers, and for validate checks representative names and opening dates, to the NTS/data.go.kr API. Before use, ensure NTS_BASE is unset or pinned to the official HTTPS endpoint, avoid running in environments with untrusted inherited variables, and treat generated audit files as sensitive business records.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/_common.sh:5
Finding

Environment-Controlled API Endpoint Can Exfiltrate Credentials and Business Data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/_common.sh:78
Finding

NTS API Key and Request Payload Are Exposed Through Process Arguments

Content
View full analysis
&2; exit 3; } ``` ### Technical Analysis The API key is embedded in the URL passed as a command-line argument to `curl`. The JSON request is also supplied through the `--data` command-line argument. While the process is running, operating-system process inspection interfaces may expose these values. Depending on platform configuration, local users, privileged monitoring agents, audit systems, process telemetry, or diagnostic tools may capture: - The full URL, including `serviceKey`. - The complete JSON request body. - Representative names and other KYB fields submitted to the validation endpoint. TLS protects data in transit but does not protect secrets exposed locally before `curl` transmits them. URL encoding the API key also does not provide confidentiality. ### Attack Path 1. A legitimate user exports `NTS_API_KEY` and invokes an API-backed script. 2. The script starts `curl` with the credential-bearing URL and JSON body in its argument vector. 3. A local observer monitors process arguments using facilities such as `ps`, `/proc`, process auditing, endpoint telemetry, or privileged monitoring software. 4. The observer captures the API key and any sensitive request fields while the process is active. 5. The captured key is reused to make unauthorized API requests or consume the victim's quota. Exploitation generally requires local process-observat ...[truncated 577 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (20)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
| `scripts/status.sh` | `POST /v1/status` | yes | Look up operating status (계속사업자/휴업자/폐업자) for up to 100 b_no per call. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
| `scripts/status.sh` | `POST /v1/status` | yes | Look up operating status (계속사업자/휴업자/폐업자) for up to 100 b_no per call. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
| `scripts/status.sh` | `POST /v1/status` | yes | Look up operating status (계속사업자/휴업자/폐업자) for up to 100 b_no per call. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
| `scripts/status.sh` | `POST /v1/status` | yes | Look up operating status (계속사업자/휴업자/폐업자) for up to 100 b_no per call. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
| `scripts/status.sh` | `POST /v1/status` | yes | Look up operating status (계속사업자/휴업자/폐업자) for up to 100 b_no per call. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
| `scripts/bulk.sh` | `POST /v1/status` | yes | Read a file of b_no's, checksum-filter, batch-call status in groups of 100. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
| `scripts/bulk.sh` | `POST /v1/status` | yes | Read a file of b_no's, checksum-filter, batch-call status in groups of 100. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
| `scripts/bulk.sh` | `POST /v1/status` | yes | Read a file of b_no's, checksum-filter, batch-call status in groups of 100. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md
| `scripts/bulk.sh` | `POST /v1/status` | yes | Read a file of b_no's, checksum-filter, batch-call status in groups of 100. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
| `scripts/bulk.sh` | `POST /v1/status` | yes | Read a file of b_no's, checksum-filter, batch-call status in groups of 100. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
| `scripts/bulk.sh` | `POST /v1/status` | yes | Read a file of b_no's, checksum-filter, batch-call status in groups of 100. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
| `scripts/bulk.sh` | `POST /v1/status` | yes | Read a file of b_no's, checksum-filter, batch-call status in groups of 100. |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README encourages use of the validate command with a business number, opening date, and representative name, but it does not clearly disclose that these identifiers are sent to an external government API. This creates a privacy and data-handling risk because operators may unknowingly transmit personal or sensitive business information outside their environment, which is especially relevant in onboarding and KYB workflows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill explicitly instructs users to run shell scripts and call external NTS endpoints, but it does not declare any tool scope such as allowed tools or permissions. In an agent environment, missing scope boundaries can let the skill invoke broader shell or network capabilities than users or orchestrators expect, increasing the risk of unintended outbound requests, data exposure, or command misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example writes vendor audit output to /tmp/vendor-audit.jsonl, a shared temporary location that may be readable by other local users or accidentally consumed by unrelated processes. The data includes business registration numbers, operating status, tax classification, and closure dates, which can expose sensitive supplier due-diligence results and create privacy or business-confidentiality risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_common.sh (reported line 5)May include surrounding context.

sh
# Shared helpers for nts-bizno-cli scripts.
set -euo pipefail

NTS_BASE="${NTS_BASE:-https://api.odcloud.kr/api/nts-businessman/v1}"

require_key() {
  if [[ -z "${NTS_API_KEY:-}" ]]; then

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_common.sh (reported line 82)May include surrounding context.

sh
local path="$1" body_json="$2" body http key_q
  key_q="serviceKey=$(urlencode "$NTS_API_KEY")"
  body=$(mktemp); trap 'rm -f "$body"' RETURN
  http=$(curl -sS -o "$body" -w '%{http_code}' \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -X POST \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This code performs a network request using the collected business numbers, which may be sensitive business data depending on context. Although the header comments describe batching and mention that valid numbers are sent to NTS, there is no interactive confirmation or explicit runtime disclosure before transmission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file includes Korean-only status labels and output strings such as 폐업, 면세사업자, and 한종희, but does not state that the skill is intended specifically for Korean tax workflows or offer an alternative language. This can violate language/locale policy when a skill implicitly forces a specific locale without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script sends the provided business registration numbers to a remote NTS API via nts_post, which is a network operation transmitting user-supplied data. While the header comments describe usage and output, this file does not include a user-facing warning, confirmation, or explicit disclosure that the identifiers will be sent to an external service.

Content

No source excerpt is available for this finding.