Korean Gov Programs

• Outcome: Review
• Latest audit: May 28, 2026, 1:50 AM
• Version:
  1.0.8

Overview

This appears to be a legitimate Korean government-program scraper, but one helper script has a local path-handling flaw that could run unintended code if used with a crafted directory name.

Install only if you are comfortable running a local scraper that contacts public Korean government sites and writes files locally. Use a simple trusted output path such as ./data, avoid running scripts/stats.sh on untrusted or unusual directory names, and verify the installed package includes the reviewed scripts despite the package metadata mismatch.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and relies on network access and file writes, but does not declare any permissions or trust boundaries for those capabilities. In an agent setting, this can lead to overbroad execution where the runner grants undeclared access to the filesystem, environment, or external URLs, making review and sandboxing harder and increasing the chance of data exposure or unintended writes.

VirusTotal

65/65 vendors flagged this skill as clean.