Security audit
Security checks for vulnerabilities and agentic risk
This plugin is a straightforward Korea apartment transaction lookup tool that sends user-provided query fields to its disclosed real-estate API.
Install this only if you want OpenClaw to query a third-party Korean real-estate service with the region, apartment name, transaction type, and date range you provide. Expect Korean-focused behavior and limited supported regions; no evidence shows local file access, credential use, or persistent system changes beyond normal plugin installation.
The file begins with Korean-only descriptive text and does not state that the skill is intentionally limited to Korean speakers or provide an opt-in language choice. That can conflict with language/locale policy expectations when users are not given a documented choice of language.
The invocation guidance is overly broad and encourages users to issue natural-language requests like 'just ask' or 'Please use the installed plugin eho' without defining clear activation boundaries, expected parameters, or when the plugin should or should not be used. In an agent environment, this can cause unintended plugin invocation, parameter confusion, or misuse of the skill in contexts the user did not clearly authorize.
The tool description and several user-visible strings are written only in Korean, which imposes a specific language on users without any opt-in or alternative locale. The policy for this category requires flagging language or locale constraints when the skill does not offer a language choice or document a justified regional limitation.
The document describes the skill as tied to Korean real-estate data and only supports major regions in South Korea, but it does not explicitly frame this as a region-specific tool limitation or offer any user choice around locale. Because locale restrictions are a natural-language policy concern, this should be documented more clearly to avoid implying a default locale constraint without opt-in.
No suspicious patterns detected.
