Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real Korean hospital lookup skill, but crafted hospital search inputs can run local Python code on the user’s machine.
Review before installing. Use only if you trust the publisher and can patch the unsafe python3 -c argument handling first; otherwise a maliciously crafted hospital name or type could execute code with your user permissions. If used, store the API key with restrictive permissions and expect queries plus the service key to be sent to data.go.kr.
scripts/hospital_search.sh:54Arbitrary Python Code Execution Through the Hospital Name Argument
scripts/hospital.sh:64Arbitrary Python Code Execution Through the Hospital Type Argument
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
echo "시도: $SIDO_CD | 종별: $HOSP_TYPE" >&2
# 요청 실행
RESPONSE=$(curl -s -G "$URL" \
--data-urlencode "serviceKey=$API_KEY" \
--data "sidoCd=$SIDO_CD" \
--data "pageNo=$PAGE_NO" \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
PARAMS="${PARAMS}&yadmNm=${ENCODED_NAME}"
fi
RESPONSE=$(curl -s "${URL}?${PARAMS}")
echo "$RESPONSE" | python3 -c "
import sys, json
The skill declares connectors, shell scripts, and external API usage but does not define an explicit tool/permission boundary such as allowed tools or scoped permissions. In an agent environment, this can let the runtime invoke broader shell or network capabilities than users or reviewers expect, increasing the chance of unintended external calls or command execution.
The detail-lookup examples are underspecified because phrases like 'tell me the hours' or 'is parking available' are common follow-up questions that may refer to many contexts, not necessarily a hospital already identified by this skill. If routed without verifying the target institution, the agent may perform unintended lookups, mis-associate a hospital, or leak user context to external services.
The routing rule maps very broad Korean keywords like search/find/recommend to this skill, which can overlap with ordinary health-related conversation rather than a clear hospital lookup request. Over-broad triggering can cause the agent to invoke networked scripts unexpectedly, disclose user queries to external services, or return medical-provider suggestions when the user did not explicitly ask for that action.
The setup instructions direct users to persist a long-lived API key in a predictable plaintext path under the home directory. Secrets stored this way are vulnerable to accidental disclosure through permissive file permissions, backups, logs, shell history, or compromise by other tools running with user access.
mkdir -p ~/.config/data-go-kr
echo "YOUR_API_KEY" > ~/.config/data-go-kr/api_key
The script accesses an API key from ~/.config/data-go-kr/api_key and exits with an error if it is missing, but there is no comment or user-facing warning explaining that the skill reads a locally stored credential. For code files, access to sensitive credentials should have some form of disclosure unless clearly communicated elsewhere in the skill description, which is not available here.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
echo "시도: $SIDO_CD | 종별: $HOSP_TYPE" >&2
# 요청 실행
RESPONSE=$(curl -s -G "$URL" \
--data-urlencode "serviceKey=$API_KEY" \
--data "sidoCd=$SIDO_CD" \
--data "pageNo=$PAGE_NO" \
The curl invocation sends the serviceKey API credential to an external HTTPS endpoint, but the script does not provide a warning or disclosure that authentication data is being transmitted over the network. Although the script's purpose is to query a public API, the current file lacks any explicit notice about this credential-bearing outbound request.
The stated purpose is hospital information lookup, and network access to the public API is expected. However, directly reading a credential from ~/.config/data-go-kr/api_key introduces local secret access that is not disclosed by the manifest description and is a distinct capability beyond straightforward search behavior.
The script loads an API key from ~/.config/data-go-kr/api_key and uses it in outbound curl requests to an external API. While this is part of the script's functionality, the file provides no explicit warning that local credentials will be accessed and sent over the network.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
SELECTED=$(echo "$ITEMS" | tr ',' ' ')
fi
# 병렬로 curl 호출
for key in $SELECTED; do
ep="${EP_MAP[$key]:-}"
[ -z "$ep" ] && continue
The script reads an API key from a local file in the user's home directory, which is a privileged local-data access capability beyond pure argument-only hospital lookup logic. Even if needed for API authentication, this creates secret-handling risk because any invocation of the skill implicitly accesses local sensitive material, and the manifest/behavior should explicitly justify and constrain that access.
The trigger examples, routing logic, setup notes, and user-facing phrasing are presented only in Korean, which effectively forces a specific language experience. The file does not mention any user language choice, alternative locale, or explicit justification for restricting interaction language.
No suspicious patterns detected.