Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Naver Datalab Cli

v0.1.0

Korean search-keyword and shopping-trend analytics via the official NAVER DataLab API (openapi.naver.com/v1/datalab/*). Six subcommands wrapping 통합 검색어 트렌드 a...

0· 13·0 current·0 all-time
byChloe Park@chloepark85

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for chloepark85/naver-datalab-cli.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Naver Datalab Cli" (chloepark85/naver-datalab-cli) from ClawHub.
Skill page: https://clawhub.ai/chloepark85/naver-datalab-cli
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install chloepark85/naver-datalab-cli

ClawHub CLI

Package manager switcher

npx clawhub@latest install naver-datalab-cli
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's name/description and included scripts align with calling NAVER DataLab endpoints. However the registry metadata claims 'Required env vars: none' while both SKILL.md and the scripts require NAVER_CLIENT_ID and NAVER_CLIENT_SECRET. That metadata omission is inconsistent with the declared purpose and the code.
Instruction Scope
SKILL.md and the scripts instruct only to call NAVER's openapi.datalab endpoints, parse results to JSONL, and optionally pipe to jq/csv tools. The runtime instructions do not ask the agent to read unrelated system files or send data to third-party endpoints. The scripts do use mktemp and curl and expect environment creds; this is reasonable for an API client.
Install Mechanism
There is no install spec (instruction-only), but the package contains multiple executable shell scripts and examples. That is workable if files are provided to the agent, but it's a mild mismatch between 'instruction-only' and the presence of runnable code — the user should confirm how files will be delivered/executed by the platform.
!
Credentials
The scripts require NAVER_CLIENT_ID and NAVER_CLIENT_SECRET (appropriate and minimal for the declared API access). However the skill metadata did not declare these required env vars or mark a primary credential, creating an inconsistency that could hide the need to supply secrets at install time.
Persistence & Privilege
The skill does not request always:true and does not modify system/global settings. It runs as invoked and requires no elevated privileges.
What to consider before installing
This package is a straightforward wrapper around NAVER DataLab, but there are a few things to verify before installing: - Expect to provide NAVER_CLIENT_ID and NAVER_CLIENT_SECRET (the SKILL.md and scripts require them), even though the registry metadata omits them. Do not paste secrets into public places. - Review the included shell scripts (scripts/*.sh) before running. They perform network calls to https://openapi.naver.com/v1/datalab and create a temporary file via mktemp — nothing else is exfiltrated by the scripts, but you should confirm the code matches the upstream source. - Verify provenance: README references a GitHub repo (ChloePark85) but the registry owner ID differs; confirm you trust the source or fetch the code directly from the GitHub repository linked in the README before running. - Run initial tests in an isolated environment or container and avoid exporting credentials into long-lived shells if you are unsure. If you want to proceed, set NAVER_CLIENT_ID and NAVER_CLIENT_SECRET in the environment and ensure curl and jq are installed. If the registry/installation UI does not prompt for the NAVER credentials (because metadata omitted them), manually supply them only after reviewing the code and confirming the endpoint is openapi.naver.com.

Like a lobster shell, security has layers — review code before you run it.

latestvk977tk4qc49j2zfdte264tawc985nm8r
13downloads
0stars
1versions
Updated 3h ago
v0.1.0
MIT-0

naver-datalab-cli

Command-line wrapper for the NAVER DataLab Open API — Korea's primary search-keyword and shopping-insight trend service. The Korean equivalent of Google Trends, with two key advantages on KR-market analysis:

  1. NAVER drives ~55% of Korean search traffic (vs ~35% Google), so its trends are closer to real Korean demand.
  2. 쇼핑인사이트 exposes shopping-cart-level trends across 50+ category trees with breakdown by device / age / gender — Google Trends cannot do this.

Six subcommands, one per official endpoint:

CommandEndpointPurpose
scripts/search.sh/v1/datalab/search통합 검색어 트렌드 — compare up to 5 keyword groups (each with up to 20 synonyms) over time.
scripts/shop-cat.sh/v1/datalab/shopping/categories쇼핑인사이트 분야별 트렌드 — compare shopping-category click volumes.
scripts/shop-keyword.sh/v1/datalab/shopping/category/keywords분야 내 키워드 트렌드 — within one category, compare keyword interest.
scripts/shop-device.sh/v1/datalab/shopping/category/deviceDevice split (pc / mo) for one category.
scripts/shop-gender.sh/v1/datalab/shopping/category/genderGender split (f / m) for one category.
scripts/shop-age.sh/v1/datalab/shopping/category/ageAge split (10/20/30/40/50/60) for one category.

All output is JSONL (one row per period per group) so it pipes directly into jq, csvkit, pandas, or downstream skills.

When to use this skill

  • SEO / content planning — pick the higher-volume of "전기차 보조금" vs "EV 보조금" before writing.
  • K-commerce demand sensing — see which sub-category in 화장품/미용 spiked last month before pitching.
  • Campaign timing — confirm "수능 도시락" peaks early-November before launching ads.
  • Brand health — compare brand keyword vs competitor weekly.
  • Influencer / blog audit — back trend claims with NAVER's first-party numbers.
  • Multi-platform AI agents — feed Korean trend signals into chat/blog/video generators.

Do not use this skill for

  • Absolute search volume — DataLab returns relative indices (0–100 range, normalized to the period peak), not raw query counts. NAVER intentionally never publishes raw counts.
  • Real-time trends — DataLab data lags ~24-48 hours.
  • Google / YouTube / 다음 trends — use google-trends or platform-specific skills.
  • Naver search results pages — use naver-search (existing ClawHub skill).

Prerequisites

  1. Register a NAVER Developers application at https://developers.naver.com/apps/#/register:
    • Choose 검색어트렌드 AND 쇼핑인사이트 when picking APIs (you need both for full coverage).
    • Application type: usually Web 서비스 with localhost callback is fine for personal use.
    • Approval is automatic — no business-day wait.
  2. Export credentials:
    export NAVER_CLIENT_ID='abcdEFG12345'
    export NAVER_CLIENT_SECRET='AbCdEfGhIj'
    
  3. Dependencies: bash, curl, jq (default on macOS/Linux).

Free-tier quota: 25,000 req/day for /v1/datalab/search, 1,000 req/day for shopping endpoints.

Commands

1. search — 통합 검색어 트렌드

Compare up to 5 keyword groups over a time range:

scripts/search.sh \
  --start 2024-01-01 --end 2024-12-31 --time-unit month \
  --group "한국어:한국어,한글" \
  --group "영어:영어,English"

Optional filters: --device pc|mo, --gender f|m, --ages 1,2,3 (1=under 12, 2=13-18, 3=19-24, 4=25-29, 5=30-34, 6=35-39, 7=40-49, 8=50-59, 9=60+). Up to 5 --group blocks; each group has 1-20 keywords.

Output (one record per group per period):

{"groupName":"한국어","period":"2024-01-01","ratio":78.32}

2. shop-cat — 쇼핑인사이트 분야별 트렌드

scripts/shop-cat.sh \
  --start 2024-01-01 --end 2024-12-31 --time-unit month \
  --category "패션의류:50000000" \
  --category "화장품/미용:50000002"

Same filters as search. Up to 3 categories per call. Category IDs come from https://datalab.naver.com/shoppingInsight/sCategory.naver.

3. shop-keyword — 분야 내 키워드 트렌드

Drill into one category:

scripts/shop-keyword.sh \
  --start 2024-06-01 --end 2024-12-31 --time-unit week \
  --category 50000000 \
  --keyword "원피스:원피스" \
  --keyword "치마:치마,스커트"

4-6. shop-device / shop-gender / shop-age

Single-category breakdown by demographic:

scripts/shop-device.sh --start 2024-01-01 --end 2024-06-30 --time-unit month --category 50000000
scripts/shop-gender.sh --start 2024-01-01 --end 2024-06-30 --time-unit month --category 50000000
scripts/shop-age.sh    --start 2024-01-01 --end 2024-06-30 --time-unit month --category 50000000

Output rows include the demographic dimension:

{"period":"2024-01-01","group":"pc","ratio":42.1}
{"period":"2024-01-01","group":"mo","ratio":100.0}

Examples

See examples/ for canned recipes:

  • examples/yearly-search.sh — yearly comparison "전기차 vs 하이브리드".
  • examples/k-beauty-by-age.sh — 화장품/미용 demographic split.
  • examples/seasonal-campaign.sh — find "수능 도시락" peak month.

Quirks the API doesn't document well

  • timeUnit accepts date, week, monthnot day. (Date with daily granularity is date.)
  • period returned by daily/weekly is the start of the bucket, not the end.
  • For shopping endpoints, the body field is category (singular) for the breakdown calls but category (array of objects) for categories. The wrapper hides this.
  • Empty result → API returns 200 OK with empty results[].data. The wrapper emits no JSONL lines for that group; check exit status and stderr.
  • The ratio is relative, not absolute. The peak point in the entire response is normalized to 100.

Categorical spec (excerpt)

CodeName
50000000패션의류
50000001패션잡화
50000002화장품/미용
50000003디지털/가전
50000004가구/인테리어
50000005출산/육아
50000006식품
50000007스포츠/레저
50000008생활/건강

Full tree: https://datalab.naver.com/shoppingInsight/sCategory.naver.

Pairs with

  • naver-papago-translate — translate the trend report into EN/JP/ZH for cross-market briefs.
  • tistory-api-cli / velog-cli — publish weekly Korean-trend posts.
  • kr-holiday-cli — overlay holiday/business-day calendar to interpret seasonal spikes.
  • kakao-local-cli + juso-address-cli — geo-resolve any place names that emerge from trend keywords.

Comments

Loading comments...