ClawHub
Back to skill

Security audit

OpenDART Disclosure

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently fetches Korean corporate disclosure data from OpenDART, with only ordinary API-key and local-cache cautions.

Install only if you are comfortable giving the agent network access to OpenDART and an OpenDART API key. Prefer setting OPENDART_API_KEY through your normal secret-handling mechanism instead of using --api-key, and expect the helper to cache OpenDART company-code data under ~/.cache/opendart/.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
scripts/opendart.py:210
Finding

OpenDART API Key May Be Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/opendart.py:23-26, 210 and SKILL.md:43-47
Vulnerability Type: Credential exposure through command-line arguments
Risk Level: Low

Vulnerable Code

python
def get_api_key(cli_key: str | None) -> str:
    key = cli_key or os.getenv("OPENDART_API_KEY")
    if not key:
        raise SystemExit("Missing API key. Use --api-key or set OPENDART_API_KEY")
    return key
python
p.add_argument("--api-key", help="OpenDART API key (fallback: OPENDART_API_KEY)")

The corresponding documentation explicitly advertises this invocation method:

markdown
API key options:

- `--api-key <KEY>`
- or env var `OPENDART_API_KEY`

Technical Analysis

The script permits an OpenDART API credential to be supplied directly as a process argument. Command-line arguments can be recorded in shell history and may be visible in process metadata to other local users or monitoring tools, depending on operating-system permissions and configuration.

The API key is subsequently transmitted as the documented crtfc_key query parameter over HTTPS exclusively to OpenDART endpoints. That network transmission is necessary for the Skill’s declared functionality and is not evidence of unrelated data exfiltration. The vulnerability is the local handling and documented command-line entry of the secret, not its authenticated transmission to OpenDART.

Attack Path

  1. A user follows the documented option and runs the script with --api-key &lt;KEY&gt;.
  2. The complete command may be stored in shell history or temporarily exposed through process-inspection facilities.
  3. A local attacker or process with sufficient access reads the command-line argument or history file.
  4. The attacker extracts and reuses the OpenDART API key.
  5. The attacker makes authenticated OpenDART requests under the victim’s credential and consumes its associated quota.

This path requires local visibility into the user’s command history or ...[truncated 443 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the --api-key argument and accept the credential through OPENDART_API_KEY, a permission-restricted credential file, or an interactive hidden prompt.
  2. If backward compatibility requires retaining the option, mark it as insecure in both CLI help and SKILL.md, and recommend the environment variable or hidden prompt as the default method.
  3. Avoid placing secret values in example commands, logs, exceptions, or diagnostic output.
  4. Document appropriate permissions for any credential file and ensure it is excluded from source control.
  5. Consider supporting standard input or getpass.getpass() for interactive use so the key is not echoed or retained in shell history.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill invokes local scripts and documents use of environment variables, file access, and outbound API requests, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates a trust-boundary problem: an agent may execute broader capabilities than a reviewer or user expects, increasing the risk of unintended file, environment, or network access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instruction says to add a concise Korean summary when asked, which imposes a specific language behavior in the skill guidance. Because no user language choice or opt-in is offered elsewhere, this can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs use of an API key via command flag or environment variable but gives no warning that requests are sent to an external service or that credentials must be handled carefully. This can lead users or agents to expose secrets in command history, logs, or unsafe execution contexts without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The helper builds and sends network requests, and later callers include the OpenDART API key as a query parameter. Although this network use is central to the tool's purpose, the code does not provide any user-facing print/log/comment/docstring warning that the supplied key will be sent to the remote OpenDART service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script creates ~/.cache/opendart and writes corpcode.json, but there is no confirmation, log message, or explanatory comment/docstring informing users that local filesystem state will be modified. This is a file write operation that could surprise users of a search utility if undocumented.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.