Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

국토부 부동산 실거래가

v2.2.0

MOLIT apartment real transaction price API

0· 481·0 current·0 all-time
by김성우@sw326
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's stated purpose (query MOLIT real transaction API) matches the network call in scripts/real_estate.sh, so functionality is coherent. However, the metadata claims no required config/credentials while SKILL.md and the script both rely on a local API key file — that discrepancy is unexpected and disproportionate to the stated metadata.
!
Instruction Scope
SKILL.md instructs storing the API key at ~/.config/data-go-kr/api_key, but scripts/real_estate.sh opens '/home/scott/.config/data-go-kr/api_key' (an absolute, user-specific path). The script reads a local file and makes outbound HTTPS calls to the public MOLIT endpoint (expected), but the hardcoded /home/scott path is out-of-scope for a general skill and may cause accidental disclosure or failed runs.
Install Mechanism
No install spec (instruction-only plus an included script). Nothing is downloaded or extracted from arbitrary URLs; risk from install mechanism is low.
!
Credentials
The skill requires an API key to call data.go.kr, yet registry metadata declares no required env vars or config paths. The SKILL.md suggests storing a key in ~/.config/data-go-kr/api_key but the script ignores that and reads a hardcoded '/home/scott' path. This is a mismatch and an overreach (the skill should declare a single, configurable credential location or allow passing the key via env var).
Persistence & Privilege
The skill is not always-enabled and does not request system-wide privileges. It does not modify other skills or global configuration in the provided materials.
What to consider before installing
The skill implements the claimed MOLIT API calls, but it contains a clear inconsistency: SKILL.md tells users to save their API key at ~/.config/data-go-kr/api_key while the script reads /home/scott/.config/data-go-kr/api_key. Before installing or using this skill: 1) Inspect and edit scripts/real_estate.sh to remove the hardcoded '/home/scott' path (use $HOME or the documented ~/.config path, or better accept an env var). 2) Require the skill metadata to declare the config path or env variable for the API key so the agent can surface that requirement. 3) Consider storing the key with correct permissions and avoid putting secrets into logs; note the script sends the key as a URL parameter (common for this API) which can show up in server logs—if concerned, prefer POST or server-side proxying. 4) Test the script in a sandbox with your key and confirm it only queries apis.data.go.kr and prints results. If you are not comfortable editing the script to remove the hardcoded path, do not install the skill.

Like a lobster shell, security has layers — review code before you run it.

koreavk97e51t12vf3dyhfwgmh6pt8cn81mxtxkoreanvk97e51t12vf3dyhfwgmh6pt8cn81mxtxlatestvk97e51t12vf3dyhfwgmh6pt8cn81mxtxpropertyvk97e51t12vf3dyhfwgmh6pt8cn81mxtxreal-estatevk97e51t12vf3dyhfwgmh6pt8cn81mxtx
481downloads
0stars
1versions
Updated 7h ago
v2.2.0
MIT-0

Real Estate Transaction Skill

MOLIT apartment sale transaction data + law integration.

Overview

KeyValue
ProviderMOLIT (Ministry of Land, Infrastructure and Transport)
Service ID15126469
Auth~/.config/data-go-kr/api_key
Endpointhttps://apis.data.go.kr/1613000/RTMSDataSvcAptTrade
Legal basisReal Estate Transaction Report Act
Playbookplaybook.md

Scripts

scripts/
└── real_estate.sh [district_code] [YYYYMM] [rows]

Workflow

Step 1: Identify district & period

  • "강남 아파트" → Gangnam-gu (11680), current month
  • Refer to playbook.md for watchlist areas
  • Default: current month; if empty, try recent 3 months

Step 2: Fetch transaction data

  • real_estate.sh [code] [YYYYMM]

Step 3: Analyze

  • Price per pyeong (area ÷ 3.3058)
  • YoY comparison (on request)
  • ~~search for market trend supplement

Step 4: Law integration (~~law, optional)

  • Rental disputes → Housing Lease Protection Act
  • Sales → Real Estate Transaction Report Act

Step 5: Structured response

Output Template

## 🏠 [District] Apartment Transactions

### Recent Transactions
| Apt | Area | Floor | Price | Per Pyeong | Date |
|-----|------|-------|-------|-----------|------|

### 📊 Summary
- Avg price: X억
- Avg per pyeong: X만/평
- Total transactions: X

### 💡 Notes
[Trend / related law info]

Key District Codes (Seoul)

DistrictCodeDistrictCode
Jongno11110Mapo11440
Yongsan11170Gangnam11680
Seocho11650Songpa11710
Gangdong11740Yeongdeungpo11560
Seongdong11200Gwanak11620

Other Cities

DistrictCode
Busan Haeundae26350
Daegu Suseong27200
Incheon Yeonsu28185
Daejeon Yuseong30200

Response Fields (XML → English keys since 2026)

KeyDescription
aptNmApartment name
umdNmDistrict name
excluUseArExclusive area (㎡)
floorFloor
dealAmountPrice (만원, comma-separated)
dealYear/Month/DayTransaction date
dealingGbnTransaction type
buildYearYear built

Connectors

PlaceholderPurposeCurrent Tool
~~realestateTransaction APIMOLIT data.go.kr
~~lawLegal referenceslaw.go.kr
~~searchTrend supplementBrave Search
~~notifyAlertsTelegram

Intent Router

#IntentTrigger ExpressionOutput
1Price Check"강남 아파트 실거래가", "최근 거래 보여줘"Transaction list + summary
2Trend Analysis"송파 시세 추이", "6개월간 가격 변화"Multi-month comparison
3Area Comparison"강남 vs 서초 비교", "강남3구 어디가 비싸?"Side-by-side district table

Details: see Workflow above.

Cross-Skill Integration

TriggerPartner SkillHow
"관련 법률도", 임대차/전세 분쟁law-search (~~law)주택임대차보호법, 부동산거래신고법 검색
"주변 환경도", 입지 분석kma-weather (~~weather)해당 지역 기후/환경 데이터 보강
"투자 관점에서"finance-sector-analysis부동산 섹터(XLRE) 분석 연동

Cross-Skill: Real Estate + Legal Context

  1. real_estate.sh → transaction data
  2. law-search → 관련 법률 (주택임대차보호법, 부동산거래신고법 등) (via ~~law)
  3. Append legal references to report

Cross-Skill: Real Estate + Location Environment

  1. real_estate.sh → transaction data
  2. kma-weather → 지역 기후/미세먼지 데이터 (via ~~weather)
  3. Add environmental context to area comparison

Notes

  1. District code: 5 digits (시군구 level)
  2. Contract month: YYYYMM format
  3. dealAmount contains commas → parse as string
  4. Data delay: 1-2 months after actual transaction
  5. Pagination: increase pageNo for large datasets

Cowork architecture v2.2 — 🦞 chumjibot (2026-02-19)

🔧 Setup (공공데이터 포털 API)

  1. data.go.kr 회원가입
  2. 로그인 → 마이페이지 → 일반 인증키(Decoding) 복사
  3. API 키 저장:
    mkdir -p ~/.config/data-go-kr
    echo "YOUR_API_KEY" > ~/.config/data-go-kr/api_key
    
  4. 아래 서비스 활용신청 후 사용 (자동승인)

Comments

Loading comments...