kakao-local-cli

Command-line tool for Kakao Local API supporting keyword/category place search, geocoding, and reverse geocoding with JSON output and API key authentication.

Security Scan

The skill's behavior (a Kakao Local CLI requiring a KAKAO_REST_API_KEY and installing from GitHub) mostly matches its description, but there are metadata inconsistencies (registry says no required env/homepage while SKILL.md declares them) and no code was provided for review — verify the GitHub repo and inspect code before installing.

Purpose & Capability

The declared runtime requirement (KAKAO_REST_API_KEY in SKILL.md) is coherent with a Kakao Local API CLI. However the registry-level metadata provided earlier in the package summary claims no required env vars and no homepage; that conflicts with the SKILL.md which lists KAKAO_REST_API_KEY and a GitHub homepage. This discrepancy between manifest layers reduces trust.

Instruction Scope

SKILL.md contains only installation instructions (pipx/pip after cloning) and usage examples (search/geocode/reverse). It does not instruct reading unrelated files, exfiltrating data, or accessing additional credentials beyond the Kakao API key.

Install Mechanism

This is an instruction-only skill with no install spec in the registry; SKILL.md tells users to clone the GitHub repo and run pipx install . or pip install . locally. Installing directly from an external repo is common but carries typical risks: the code on GitHub must be reviewed before pip installing since the skill package provides no embedded code for automated review.

Credentials

Requesting a single KAKAO_REST_API_KEY is proportionate for a CLI that calls Kakao's REST API. No other credentials or sensitive environment access are requested in SKILL.md. The inconsistency is that registry metadata earlier stated 'none' for required env — this should be reconciled.

Persistence & Privilege

The skill is not always-enabled and is user-invocable; it does not request any elevated or persistent platform privileges. As an instruction-only skill it does not itself write files or modify agent configuration.

What to consider before installing

This skill appears to do what it says: a small CLI wrapper around Kakao Local requiring your Kakao REST API key. However: (1) the SKILL.md declares KAKAO_REST_API_KEY and a GitHub homepage but the registry metadata you were shown earlier does not — verify which is authoritative. (2) Because the package is instruction-only and points to a GitHub repo for installation, inspect the repository code before running pip install/pipx install. (3) Limit the API key's permissions and consider creating a dedicated key you can revoke if needed. (4) If you want higher assurance, ask the publisher for a release tarball or a verified package on a well-known registry, or request that code be embedded for review.

Kakao Local API를 위한 경량 CLI 도구이다. 키워드/카테고리 장소검색, 주소→좌표(geocode), 좌표→주소(reverse-geocode)를 지원한다. Linux/macOS/Windows 어디서나 실행 가능하며 STDIN/STDOUT 기반 JSON 출력을 기본으로 하여 에이전트·자동화 파이프라인에 적합하다. 인증은 환경변수 KAKAO_REST_API_KEY로 설정한다.

설치

• pipx install . 또는 pip install . (레포 클론 후)
• 저장소: https://github.com/ChloePark85/kakao-local-cli

사용법 예시

• 키워드 검색 kakao-local search --query "카카오프렌즈" --x 126.9784 --y 37.5666 --radius 5000
• 카테고리 검색 (카페: CE7) kakao-local search --category CE7 --x 126.9784 --y 37.5666 --radius 1000
• 지오코딩 (주소→좌표) kakao-local geocode --query "서울특별시 중구 세종대로 110"
• 리버스 지오코딩 (좌표→주소) kakao-local reverse --x 126.9784 --y 37.5666

환경변수

• KAKAO_REST_API_KEY: Kakao Developers REST API 키 (필수)