Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Bank of Korea ECOS CLI

v0.1.0

Command-line client for Bank of Korea ECOS API to list statistic tables and fetch time series data in JSON by code and frequency.

0· 84·0 current·0 all-time
byChloe Park@chloepark85

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for chloepark85/bank-of-korea-ecos-cli.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Bank of Korea ECOS CLI" (chloepark85/bank-of-korea-ecos-cli) from ClawHub.
Skill page: https://clawhub.ai/chloepark85/bank-of-korea-ecos-cli
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: BOK_API_KEY
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install bank-of-korea-ecos-cli

ClawHub CLI

Package manager switcher

npx clawhub@latest install bank-of-korea-ecos-cli
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (ECOS CLI) aligns with the single required env var (BOK_API_KEY). However, the installation instructions assume a local Python package (pip install -e .) and say "Clone and run" but do not provide a repository URL or any packaged binary — the skill bundle contains no code. That mismatch is unexplained.
Instruction Scope
SKILL.md only instructs using the ECOS API via an ecos-cli command and reading BOK_API_KEY/BOK_LANG. It does not request unrelated files, paths, or extra credentials. The scope is appropriate for the described function, but the runtime instructions assume a local project layout (venv, pip install -e .) that isn't present or linked.
Install Mechanism
There is no install spec in the registry (instruction-only skill), which is low-risk. The only install instructions are in SKILL.md and require cloning/packaging a local Python project — but no external download URL or package is provided by the skill itself.
Credentials
Only one credential is required (BOK_API_KEY) and that matches the API the CLI is meant to call. The optional BOK_LANG is reasonable. There are no other env vars or secrets requested.
Persistence & Privilege
The skill is not always-enabled and allows user invocation/autonomous invocation per platform defaults. It does not request persistent system-wide privileges or modify other skills' configs.
What to consider before installing
This skill appears to describe a legitimate ECOS CLI and only needs your ECOS API key, but the SKILL.md expects you to clone and install a local Python package yet provides no repository or packaged code. Before installing or providing your BOK_API_KEY: 1) Ask the skill author for the repository URL or a packaged release you can inspect. 2) If you clone/install code, review it locally (or in an isolated environment) before running pip install -e . 3) Confirm ecos-cli is a known tool or comes from a trusted source; do not paste your API key into unknown scripts. 4) If you only need to call ECOS, consider using curl or writing a small script yourself that calls the documented endpoints so you control the code that sees the key.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

EnvBOK_API_KEY
Primary envBOK_API_KEY
latestvk9701gw7tqb1wmqms6b81rbhzn85a51k
84downloads
0stars
1versions
Updated 6d ago
v0.1.0
MIT-0

Bank of Korea ECOS CLI

Minimal command-line client for the Bank of Korea Economic Statistics System (ECOS) Open API.

  • List available statistic tables
  • Fetch time series by statistic code and frequency (A,S,Q,M,D)
  • JSON output, suitable for piping to jq or saving to files

Installation

Clone and run in a virtualenv (or install once on your host/agent image):

python -m venv .venv && source .venv/bin/activate
pip install -e .

Usage

Environment variables:

  • BOK_API_KEY (required) — your ECOS API key
  • BOK_LANG (optional) — kr or en (default: kr)

Examples:

# Help
ecos-cli -h

# List statistic tables (first 1000)
ecos-cli table-list | jq '.[] | .[]? // .'

# Fetch a monthly time series for a statistic code between start/end dates
ecos-cli series 722Y001 M 202001 202412 | jq .

Notes:

  • Date formats depend on the cycle: YYYY for A/S, YYYYQQ for Q (ECOS accepts YYYYQ# in some cases), YYYYMM for M, YYYYMMDD for D.
  • Output structure is a direct passthrough of the ECOS JSON response.

API references

  • ECOS API portal: https://ecos.bok.or.kr/api/
  • StatisticTableList: /StatisticTableList/{API_KEY}/json/{lang}/{start}/{end}/
  • StatisticSearch: /StatisticSearch/{API_KEY}/json/{lang}/{start}/{end}/{STAT_CODE}/{CYCLE}/{START}/{END}/

Comments

Loading comments...