Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Naver Korean-news search helper that uses disclosed Naver API credentials and does not show hidden execution, exfiltration, or destructive behavior.
Install this if you intend to use Naver for Korean news search and are comfortable providing Naver API credentials. Search terms and credentials are sent to Naver during use, and any cron-based daily summary workflow should be enabled deliberately because it may update a local timestamp state file.
The skill declares that it requires environment variables and uses a networked API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates ambiguity about what execution capabilities the agent may use and weakens least-privilege controls, increasing the chance of unintended network access or secret exposure during execution.
The description uses broad activation language like 'use when searching for Korean news' and 'preparing daily news summaries,' which can cause the skill to trigger for a wide range of generic news-related requests. Over-broad routing is a security and safety concern because it can invoke networked code unexpectedly, increasing data exposure and reducing user control over when external services are contacted.
The skill is hard-scoped to Korean news without documenting a user locale or source preference opt-in. This can lead to unsolicited routing to a region-specific external service, which may not match user expectations and can create privacy, relevance, or policy issues when queries are sent to a third-party provider without explicit user choice.
The file hardcodes Korean search terms such as 인공지능 IT, 게임, and 경제 정치 외교, and the prioritization guidance is explicitly Korea-focused, while presenting the workflow as a general daily summary example. There is no opt-in, alternative locale, or statement that this skill is intended only for Korean-language/Korea-specific use.
This markdown file describes a skill that searches and collects Korean news via the Naver Search API, which implies network requests and data transmission to a third-party service. The README does not include any user-facing warning about external API calls, privacy considerations, or that user-provided queries will be sent to Naver.
The README states that the skill searches Korean news articles and is designed around that locale, but it does not indicate whether this restriction is optional, user-selected, or justified as a region-specific tool. Under the policy, a language or locale constraint should either be optional or clearly documented as intentional and justified.
This markdown file instructs the skill to update memory/news-state.json after each run, which is a file-write operation affecting local state. The document describes the behavior operationally but does not explicitly warn users that automation will persist and overwrite timestamp data on disk.
The formatted news output uses Korean labels ("발행", "요약") and the main result summary later also uses Korean-only text, which forces a specific language in user-facing behavior. This matches the language/locale policy concern because the script does not provide any opt-in, selection mechanism, or justification that it is intended only for Korean-speaking users.
The script prints the main search summary in Korean only, which imposes a fixed language on all users. Because there is no configuration or documented reason for this locale restriction, it is a natural-language policy violation under the language/locale rule.
No suspicious patterns detected.
