MIJ Kakao Local API (PowerShell)

• Outcome: Pass
• Latest audit: May 28, 2026, 1:09 PM
• Version:
  1.0.0

Overview

This skill is a straightforward Kakao local search helper, but users should treat searched addresses, coordinates, cache files, and the Kakao API key as sensitive.

Install only if you are comfortable sending address, place-search, and optional coordinate queries to Kakao. Prefer the environment variable setup for the API key, do not commit data/config.json, and treat any places.json or cache.json files as private location/search history that should be deleted or protected when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill clearly instructs users to send addresses, place-search keywords, and optional coordinates to an external Kakao API, but it does not prominently disclose the privacy implications of transmitting potentially sensitive location data off-host. This can lead to unintentional disclosure of personal or sensitive location information by higher-level agents or users who assume the skill is purely local.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The example workflows persist favorites, timestamps, addresses, coordinates, and search results to local JSON files without clearly warning that potentially sensitive location/search history will be stored on disk. This creates a local privacy risk because later users, processes, backups, or source-control mistakes could expose behavioral and location data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill sends user-supplied address queries, keywords, and optional precise coordinates to a third-party Kakao API, but the markdown description does not clearly warn users that this data leaves the local environment. This creates a real privacy and consent issue, especially because location data and searched places can be sensitive and may be logged or retained by the external service.

VirusTotal

64/64 vendors flagged this skill as clean.