Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Korea apartment transaction lookup tool that sends user-supplied search parameters to its real-estate API and returns the result.
Before installing, understand that searches are not purely local: region, apartment name if provided, transaction type, and date range are sent to everyhouse-real-payment.com and the full request URL is logged locally. Avoid entering sensitive personal notes or unrelated private information in search fields.
The README explicitly instructs users to install and allow a plugin that connects to an external site/API, but it does not clearly disclose that user queries and possibly location/property search terms will be transmitted to third-party services. This creates a real privacy and trust issue because users may unknowingly send sensitive interests or usage data outside the local environment.
The tool description, parameter descriptions, log messages, and returned user-facing text are all written in Korean, and there is no indication that users can opt into another language. This creates a natural-language locale restriction that may violate organizational language policy when multilingual or user-selectable language support is expected.
The documentation is written for Korean real-estate usage and provides Korean-specific invocation examples and regional scope, but it does not explicitly offer language or locale choice to users. Because SQP-3 applies to all file types and covers forced language/locale behavior without opt-in, this is a mild policy concern.
The file says the user should 'just ask' and then provides required values and an example query only in Korean, plus an English fallback phrase for plugin selection. This can be read as steering usage toward a specific language/locale without explicitly telling users they may use another language or choose their locale.
No suspicious patterns detected.
