Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Naver Finance market-data lookup tool with expected external queries and no evidence of hidden persistence, credential access, or destructive behavior.
Install only if you are comfortable with stock names, tickers, and exchange-rate queries being sent to Naver Finance. Avoid entering confidential watchlists, private notes, or proprietary identifiers as free-text queries.
User-supplied queries are sent directly to external Naver endpoints, and this file provides no notice that user input will leave the local environment. While expected for a market-data lookup skill, undisclosed transmission of user-entered text can create privacy risk if users submit sensitive or proprietary symbols, notes, or identifiers by mistake.
The skill sends user-derived stock identifiers or resolved Reuters codes to additional Naver Finance endpoints without explicit disclosure. Although necessary for functionality, this still exposes user interest patterns and query data to a third party, which is a legitimate privacy concern in a finance-related context.
The manifest says the skill fetches real-time stock prices using Naver Finance, but this code implements a separate exchange-rate retrieval path via Naver's market index API. In main(), user inputs like USD/JPY/EUR/CNY are explicitly mapped to FX codes and returned as currency rates rather than stock prices, which expands the behavior beyond the described stock-only scope.
The exchange-rate mapping and generated display name include Korean-only strings such as currency aliases and the output suffix for exchange rates. This imposes a specific language/locale in the user-facing behavior without any opt-in or alternative localization path.
No suspicious patterns detected.
