국토부 부동산 실거래가

• Analyzed: May 11, 2026, 4:34 AM
• Findings: 1
• Version: 2.2.0
• Hash: 63e647ebc3cd4f48f74870fa454f1ce3fb18fc50fcc19abd66c8ba7c766386ba
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a critical shell injection vulnerability in `scripts/real_estate.sh`. The script directly interpolates user-controlled arguments (`$1`, `$2`, `$3`) into a `python3 -c "..."` command without proper escaping. This allows an attacker, via prompt injection against the OpenClaw agent, to execute arbitrary shell commands on the host system, leading to Remote Code Execution (RCE). Additionally, the script hardcodes the API key path to `/home/scott/.config/data-go-kr/api_key`, which is a bug that may prevent the skill from functioning correctly for other users.