Naver Search MCP

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:01 AM UTC
• Version: 1.0.2

Overview

This Naver search skill has a coherent purpose, but it runs an unpinned third-party npm MCP server with access to Naver credentials, so it should be reviewed before installation.

Install only if you are comfortable trusting the current and future npm releases of @isnow890/naver-search-mcp. Prefer a pinned, reviewed package version, keep Naver credentials scoped and rotatable, and avoid placing secrets in prompts, logs, screenshots, or shared configuration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:36
• Finding: Unpinned Third-Party npm Package Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:36` **Vulnerability Type**: Unpinned dependency execution **Risk Level**: High ### Vulnerable Code ```bash npx -y @isnow890/naver-search-mcp ``` The related package declaration at `SKILL.md:17-20` is also unpinned: ```yaml install: - kind: node package: "@isnow890/naver-search-mcp" bins: - naver-search-mcp ``` ### Technical Analysis The documented `npx -y` command automatically downloads and executes the version of `@isnow890/naver-search-mcp` selected by the npm registry at invocation time. Neither the command nor the installation metadata specifies an exact audited version or an integrity hash. Consequently, the code executed by this skill can change after the skill itself has been reviewed. The external package implementation is not included in the audited project, so its behavior cannot be verified from the available artifact. This creates a supply-chain trust boundary: compromise of the package publisher account, npm artifact, or package release process could cause attacker-controlled JavaScript to execute when the documented command is invoked. The `-y` option suppresses the normal installation confirmation, further reducing opportunities for users to notice an unexpected package download. ### Attack Path 1. An attacker compromises the npm publisher account, publication pipeline, or a subsequently released package version. 2. The attacker publishes malicious code under `@isnow890/naver-search-mcp`. 3. A user or agent follows the skill documentation and runs `npx -y @isnow890/naver-search-mcp`. 4. npm resolves and downloads the unpinned package without interactive confirmation. 5. The malicious package executes with the permissions and environment of the invoking process. 6. If the documented Naver environment variables are present, the package may access `NAVER_CLIENT_ID` and `NAVER_CLIENT_SECRET`, in addition to any files and network resources available to that proc ...[truncated 880 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact reviewed version, for example: ```bash npx --yes @isnow890/naver-search-mcp@1.0.2 ``` Do not use version ranges or floating tags such as `latest`. 2. Update the installation metadata to reference the same exact version: ```yaml install: - kind: node package: "@isnow890/naver-search-mcp@1.0.2" bins: - naver-search-mcp ``` 3. Prefer installation through a committed lockfile using `npm ci`, and verify registry-provided integrity metadata before execution. 4. Review the exact package archive and its transitive dependencies before approval. Repeat this review before changing the pinned version. 5. Where operationally possible, avoid automatic `npx -y` downloads. Install the approved artifact in a controlled build or deployment stage and execute only that verified installation. 6. Run the MCP server with least privilege in an isolated process or container. Restrict filesystem access, outbound network destinations, and environment variables to those strictly required. 7. Provide short-lived or readily rotatable Naver credentials, monitor their use, and rotate them immediately if package compromise is suspected. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill installs and runs an npm-hosted MCP server without pinning an exact immutable version. This creates a supply-chain risk: a future malicious or compromised package release could be fetched and executed automatically in an environment that also exposes NAVER_CLIENT_SECRET and NAVER_CLIENT_ID.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The command `npx -y @isnow890/naver-search-mcp` pulls and executes the latest published package version at runtime. If the upstream package, maintainer account, or dependency chain is compromised, arbitrary code could run immediately with access to the configured Naver credentials and the host environment.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- In OpenClaw, `apiKey` maps to `NAVER_CLIENT_SECRET` because this skill declares `primaryEnv: NAVER_CLIENT_SECRET`.
- Provide `NAVER_CLIENT_ID` through the skill `env` config or OpenClaw environment.
- Restart OpenClaw or the Gateway after changing credentials.
- Do not ask users to clone this repository for normal use; cloning is only for development.

Example OpenClaw config:

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The skill requires a client secret and explains how to place it into configuration, but it does not explicitly warn users not to paste secrets into prompts, logs, screenshots, or shared configs. While this is documentation-level rather than code-execution risk, unclear secret-handling guidance increases the chance of accidental credential exposure.

Static analysis

No suspicious patterns detected.