ClawHub
Back to skill

Security audit

Naver Search

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate Naver search helper, but it needs review because its Python dependency loading could expose your API key and search terms in an unsafe local environment.

Review or patch the dependency-loading behavior before installing: pin and verify `serpapi`, remove the user-site `sys.path` precedence, run in a dedicated virtual environment, and avoid submitting sensitive or private queries because searches and the SerpAPI key are sent through a third-party search provider.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Runtime Dependency

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned dependency and insufficient supply-chain integrity controls
Risk Level: Medium

Vulnerable Code

text
serpapi

The documented installation procedure in README.md:47-50 instructs users to install this unconstrained dependency:

bash
pip install -r requirements.txt

Technical Analysis

The project declares serpapi without an exact version or cryptographic integrity hash. Consequently, installation resolves whichever release the package index currently considers appropriate rather than a previously reviewed and trusted artifact.

The dependency is security-sensitive because lib/naver_base.py imports it at application startup and later passes SERPAPI_API_KEY and user search queries to its search() function. A compromised, malicious, or unexpectedly modified future release could therefore execute code during installation or import and intercept these values at runtime.

This is a supply-chain weakness rather than evidence that the currently available package is malicious. The audit found no malicious dependency payload inside the project itself.

Attack Path

  1. An attacker compromises the upstream package account, distribution process, or a subsequently published serpapi release.
  2. A user follows the documented setup procedure and runs pip install -r requirements.txt.
  3. Because no version or hash is specified, the package manager installs the attacker-controlled release.
  4. Malicious code executes during package installation, import, or invocation.
  5. When a search is performed, the compromised dependency can receive the SerpAPI key and search parameters.
  6. The malicious package can exfiltrate those values or perform other actions with the invoking user's operating-system privileges.

Impact Assessment

Successful exploitation can provide arbitrary code execution under th ...[truncated 491 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin serpapi to an exact, reviewed version rather than accepting every available release.
  2. Generate a lock file containing transitive dependency versions.
  3. Record cryptographic hashes and install with hash verification, for example through pip install --require-hashes.
  4. Confirm the package name, publisher, repository, and release provenance before updating.
  5. Review dependency updates before changing the locked version.
  6. Run dependency vulnerability and provenance checks in continuous integration.
  7. Install and execute the Skill in a dedicated, non-privileged virtual environment.
  8. Avoid installing dependencies as root or with unnecessary administrative permissions.

T07 · Tool Hijacking and Spoofing

Warning
Location
lib/naver_base.py:6
Finding

User-Site Import Precedence Enables Local SerpAPI Module Hijacking

Content
View full analysis

Vulnerability Details

File Location: lib/naver_base.py:6-12
Vulnerability Type: Python module search-path hijacking
Risk Level: Medium

Vulnerable Code

python
# 유저 사이트 패키지 경로 추가 (하드코딩 제거)
user_site = site.getusersitepackages()
if user_site not in sys.path:
    sys.path.insert(0, user_site)

try:
    import serpapi

Technical Analysis

The code explicitly inserts the user-site package directory at index zero of sys.path before importing serpapi. Index zero has the highest precedence during normal Python module resolution.

This behavior can override the dependency selected by an active virtual environment or another trusted interpreter path. If a forged serpapi module exists in the user-writable site-packages directory, Python may import that module instead of the intended dependency.

Importing an attacker-controlled Python module immediately permits arbitrary code execution through its top-level statements. In addition, the forged module can implement a compatible search() function. perform_search() later invokes that function with parameters containing the SerpAPI key:

python
params["api_key"] = api_key
results = serpapi.search(**params)

Thus, a counterfeit module can remain operationally indistinguishable from the expected client while intercepting credentials and queries.

Attack Path

  1. An attacker or previously compromised local process obtains write access to the target user's site-packages directory.
  2. The attacker places a forged serpapi package or module in that directory.
  3. The user invokes any bundled search script.
  4. lib/naver_base.py inserts the user-site directory at the beginning of sys.path.
  5. Python resolves import serpapi to the attacker's module.
  6. The malicious module executes arbitrary top-level code during import.
  7. When perform_search() runs, the malicious search() function receives the SerpAPI key, search ...[truncated 981 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the manual sys.path.insert(0, user_site) modification.
  2. Allow Python to use the active interpreter or virtual environment's standard module resolution order.
  3. Install dependencies in a dedicated virtual environment with user-site packages disabled.
  4. Consider running Python with -s or setting PYTHONNOUSERSITE=1 in controlled deployments.
  5. Pin and hash the expected dependency so that installation and import provenance can be verified.
  6. Execute the Skill using a minimally privileged service account.
  7. Restrict write permissions on runtime environments and package directories.
  8. If additional import-path configuration is essential, append only validated trusted paths and never place user-writable directories before trusted environment paths.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

text
naver-search/
├── .env                  # API 키 (SERPAPI_API_KEY)
├── SKILL.md              # [Agent 전용] 사용 가이드 및 명령어 명세
├── README.md             # [User 전용] 설치 및 정보 요약
├── requirements.txt      # 의존성 패키지 (serpapi)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/naver_base.py (reported line 18)May include surrounding context.

python
```text
naver-search/
├── .env                  # API 키 (SERPAPI_API_KEY)
├── SKILL.md              # [Agent 전용] 사용 가이드 및 명령어 명세
├── README.md             # [User 전용] 설치 및 정보 요약
├── requirements.txt      # 의존성 패키지 (serpapi)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/naver_base.py (reported line 24)May include surrounding context.

python
```text
naver-search/
├── .env                  # API 키 (SERPAPI_API_KEY)
├── SKILL.md              # [Agent 전용] 사용 가이드 및 명령어 명세
├── README.md             # [User 전용] 설치 및 정보 요약
├── requirements.txt      # 의존성 패키지 (serpapi)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/naver_base.py (reported line 22)May include surrounding context.

python
api_key = os.environ.get("SERPAPI_API_KEY")

    if not api_key:
        env_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), ".env")
        if os.path.exists(env_path):
            # .env 파일 보안 강화 안내 (chmod 600 권장)
            # 실제 운영 환경이라면 여기서 파일 권한 체크 로직을 넣을 수 있음

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README explicitly instructs users to use a SerpAPI-backed search workflow but does not disclose that user queries and related metadata will be sent to a third-party provider. This creates a privacy and data-governance risk because operators may pass sensitive prompts, business data, or personal information through the skill without informed consent or controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The entire skill documentation is presented only in Korean, including invocation guidance and safety notes, with no indication that users may choose another language or that the skill is intentionally limited to a Korean-only audience. Under the language/locale policy rule, this is a natural-language policy concern unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · lib/naver_base.py (reported line 24)May include surrounding context.

python
if not api_key:
        env_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), ".env")
        if os.path.exists(env_path):
            # .env 파일 보안 강화 안내 (chmod 600 권장)
            # 실제 운영 환경이라면 여기서 파일 권한 체크 로직을 넣을 수 있음
            with open(env_path, "r") as f:
                for line in f:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The function sends arbitrary search parameters to SerpAPI over the network without any disclosure, consent, or filtering in this file. If upstream callers pass sensitive user input, personal data, or secrets in params, that data will be transmitted to a third party, creating a privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The module description and all user-facing output strings are hard-coded in Korean, which imposes a specific language on users. The file does not provide an opt-in, fallback, or documentation that this is intentionally limited to Korean-speaking or Korea-specific usage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Several user-visible strings are fixed in Korean, such as the result heading and fallback messages, but the script does not indicate that it is intentionally Korea-only or provide any language/locale opt-in. This can violate language/locale policy when a skill forces a specific language without user choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This Python file contains user-facing strings such as the results header and no-results message entirely in Korean. The skill does not provide any opt-in, configuration, or documented justification for forcing a specific language, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring and all user-facing CLI/help/output strings are written in Korean, which effectively fixes the interaction language without offering user opt-in or alternatives. Under the policy, a skill should not force a specific language or locale unless it explicitly offers a choice or clearly documents a justified regional constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/naver_search.py (reported line 21)May include surrounding context.

python
cmd.extend(extra_args)
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, check=True)
        return json.loads(result.stdout)
    except Exception:
        return None

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/naver_search.py (reported line 58)May include surrounding context.

python
if "-n" in supported and args.num: cmd.extend(["--num", str(args.num)])
        if "-s" in supported and args.sort: cmd.extend(["--sort", args.sort])
        if "-t" in supported and args.time: cmd.extend(["--time", args.time])
        subprocess.run(cmd)
        return

    # 2. 통합 검색 (Aggregating)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file contains multiple Korean-only user-facing strings in the formatter, including result headings and fallback messages. Because the skill does not provide an opt-in or alternative language path, it appears to force a specific language/locale, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script emits user-facing text such as 네이버 비디오 검색 결과, 알 수 없음, and 비디오 검색 결과가 없습니다. only in Korean. This enforces a specific language without any documented opt-in or locale selection, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The user-facing strings in this script are written in Korean, including headings and the no-results message. This can violate a language/locale policy when the skill forces a specific language without user opt-in and no region-specific justification is documented in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

Nearly all instructional content in the file is presented only in Korean, and there is no note that the skill is Korea-specific or that users may choose another language. Under the policy rule, forcing or assuming a single language without opt-in can be a natural-language policy issue unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified without a version pin, so installs may pull different releases over time. This creates supply-chain and reproducibility risk because a future upstream release could introduce breaking changes or a malicious/compromised package version that would be installed automatically.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
serpapi

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This Python file performs a network-backed search via perform_search(params) using a user-provided query, but the file contains no confirmation prompt, logging, comment, or docstring warning that the query will be sent to an external service. For code files, outbound transmission of user data should have some visible disclosure unless it is clearly documented elsewhere.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The comments at L31-L33 state that the Naver news engine does not support the tbs parameter and suggest fallback behavior, but the implementation at L58-L66 unconditionally includes tbs in the request parameters. This is an intent/documentation mismatch because the inline documentation describes a limitation and fallback approach that the code does not actually follow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This code routes requests by spawning other Python scripts and passes the user-provided query into those subprocesses. While the behavior may be functional, there is no visible confirmation prompt, print/log disclosure, or explanatory comment/docstring near the execution path informing users that their query will be processed by child processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This Python file performs a network-backed search via perform_search(params), which likely transmits the user's query to an external service. The file contains no confirmation prompt, user-facing notice, or explanatory comment/docstring disclosing that the query will be sent over the network.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.