ClawHub
Back to skill

Security audit

NTS BizNo CLI

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward NTS business-number checking CLI, with privacy and API-key handling caveats users should understand.

Install only if you are comfortable sending selected Korean business-registration details to the official NTS/data.go.kr endpoint. Keep NTS_API_KEY private, avoid overriding NTS_BASE unless you trust the endpoint, and store or redact JSONL outputs as sensitive onboarding records.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Low
Confidence
88% confidence
Finding
The README instructs users to submit a business registration number together with opening date and representative name to an external government API, but it does not clearly warn that these identifiers will be transmitted off-host or advise users to ensure they have a lawful basis to share them. In a KYB/onboarding context this can lead to inadvertent privacy, consent, or policy violations, especially when bulk-processing supplier lists containing representative-identifying data.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script places the NTS API key in the request URL as a query parameter. Even over HTTPS, query strings are commonly exposed in shell history, process listings, proxy/load-balancer logs, debugging output, and telemetry systems, which increases the chance of credential leakage beyond the intended recipient.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The script sends highly sensitive KYB/KYC-style data to an external NTS API, including business number, opening date, representative name, and optionally corporate number and business details, but provides no explicit warning, consent checkpoint, or privacy notice before transmission. In this context the network transmission is expected for the feature to work, but the lack of user-facing disclosure and safeguards still creates a real privacy and compliance risk, especially when used in batch mode with up to 100 records.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.