T09 · Insecure Skill Coding Practices
Error
- Location
scripts/law_search.sh:10- Finding
Plaintext API-Key Transmission and Python Code Injection in Law Search
- Content
View full analysis
- Remediation
View remediation
Security audit
한국 법령/판례 검색
Security checks for vulnerabilities and agentic risk
Overview
This Korean legal search skill is purpose-aligned, but its scripts expose API keys and legal queries over plaintext HTTP and contain command-execution injection risks.
Review before installing. Use only with non-sensitive queries until the scripts are fixed to use HTTPS, pass user input as data rather than Python source, validate numeric and ID parameters, and store API credentials with restrictive permissions. Be aware that legal questions and results may be sent to government APIs and, if enabled, to additional services such as search, Notion, or Telegram.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/case_search.sh:10- Finding
Plaintext API-Key Transmission and Python Code Injection in Case Search
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/life_law.sh:10- Finding
Plaintext API-Key Transmission and Python Code Injection in Everyday-Law Search
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/law_detail.sh:10- Finding
Plaintext API-Key Transmission and Python Code Injection in Statute Detail Retrieval
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:140- Finding
Credential Setup Instructions Do Not Enforce Restrictive Permissions
- Content
View full analysis
~/.config/law-go-kr/credentials.json ``` ```bash mkdir -p ~/.config/data-go-kr && echo "YOUR_KEY" > ~/.config/data-go-kr/api_key ``` ### Technical Analysis The documented setup commands create credential directories and files without explicitly setting private permissions. Their resulting modes depend on the user's current `umask`. On a system with permissive defaults, other local users or processes may be able to read the credentials. The commands also encourage users to place secret values directly in interactive shell command lines. Depending on shell configuration and how users substitute the placeholders, credentials may be retained in shell history or process-monitoring data. The credential access itself is consistent with the Skill's API functionality. The problem is the absence of least-privilege protections around credential storage. ### Attack Path 1. A user follows the setup instructions under a permissive `umask`. 2. The credential file is created with group-readable or world-readable permissions. 3. Another local user or compromised process reads the file. 4. The exposed API key or OC value is reused for unauthorized API requests. An alternative path is disclosure through shell history after a user enters the actual secret directly in the command. ### Impact Assessment The issue can disclose the law.go.kr OC value or data.go.kr API key to other local principals. An attacker could consume API quota, make requests associated with the victim, or cause service disruption through quota exhaustion. This finding does not independently grant privileges beyond those represented by the exposed credentials. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (22)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md |-----|-------| | Provider | MOLEG (Ministry of Government Legislation) | | API Source | law.go.kr (primary) + data.go.kr (fallback) | | Auth (law.go.kr) | `~/.config/law-go-kr/credentials.json` → OC code | | Auth (data.go.kr) | `~/.config/data-go-kr/api_key` | | Daily limit | 10,000 calls | | Playbook | `playbook.md` |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md |-----|-------| | Provider | MOLEG (Ministry of Government Legislation) | | API Source | law.go.kr (primary) + data.go.kr (fallback) | | Auth (law.go.kr) | `~/.config/law-go-kr/credentials.json` → OC code | | Auth (data.go.kr) | `~/.config/data-go-kr/api_key` | | Daily limit | 10,000 calls | | Playbook | `playbook.md` |
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The script fetches data from an external endpoint over plain HTTP, not HTTPS, while including the API key in the query string. This allows a man-in-the-middle to intercept or tamper with the response and steal the credential; because the response is then parsed and surfaced to the caller, attackers could inject false legal data or trigger downstream issues from malicious content.
- Content
sh ENCODED_QUERY=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$QUERY'))") RESPONSE=$(curl -s "http://apis.data.go.kr/1170000/caseSearch/caseSearchList.do?serviceKey=${API_KEY}&numOfRows=${NUM}&pageNo=1&type=XML&query=${ENCODED_QUERY}") echo "$RESPONSE" | python3 -c " import xml.etree.ElementTree as ET
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh API_KEY=$(cat ~/.config/data-go-kr/api_key) # 법령 상세 조회 RESPONSE=$(curl -s "http://apis.data.go.kr/1170000/law/lawServiceDtl.do?serviceKey=${API_KEY}&target=law&MST=${LAW_ID}&type=XML") echo "$RESPONSE" | python3 -c " import xml.etree.ElementTree as ET
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The script uses plain HTTP to contact the external API, sending the API key and query in cleartext over the network. That allows man-in-the-middle attackers or network observers to read or tamper with the response, potentially stealing the key, altering legal search results, or injecting malicious XML/error content into downstream processing.
- Content
sh ENCODED_QUERY=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$QUERY'))") RESPONSE=$(curl -s "http://apis.data.go.kr/1170000/law/lawSearchList.do?serviceKey=${API_KEY}&target=law&query=${ENCODED_QUERY}&numOfRows=${NUM}&pageNo=1") echo "$RESPONSE" | python3 -c " import xml.etree.ElementTree as ET
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The script performs an outbound request over plain HTTP and includes the API key directly in the URL query string, exposing both the credential and the user's search terms to interception, proxy logs, and other network observers. Because this is a legal-information skill, the query content may be especially sensitive, making insecure transport materially more dangerous in context.
- Content
sh ENCODED_QUERY=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$QUERY'))") RESPONSE=$(curl -s "http://apis.data.go.kr/1170000/lifeLawSearch/lifeLawSearchList.do?serviceKey=${API_KEY}&numOfRows=${NUM}&pageNo=1&type=XML&query=${ENCODED_QUERY}") echo "$RESPONSE" | python3 -c " import xml.etree.ElementTree as ET
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill documents shell scripts and outbound API usage but does not declare an explicit tool scope such as allowed tools or permissions. That mismatch can lead to over-broad execution in an agent runtime, where a legal search skill could invoke shell or network capabilities beyond what reviewers expect.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill includes connectors for saving results to Notion and sending alerts via Telegram even though its stated purpose is legal research. These extra data sinks can exfiltrate sensitive user legal questions, search results, or case details to unrelated services if the runtime enables them.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest frames the skill as using law.go.kr and data.go.kr, but later documentation adds web_search fallback and Brave Search as supplementary capability. This creates scope drift: an agent may send user legal queries to additional third parties not disclosed in the primary description, weakening reviewability and data-flow transparency.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### 법제처 국가법령정보 API (주 API) 1. [open.law.go.kr](https://open.law.go.kr) 회원가입 2. OC 코드 발급 (이메일 @ 앞부분) 3. `mkdir -p ~/.config/law-go-kr && echo '{"oc":"YOUR_OC"}' > ~/.config/law-go-kr/credentials.json` ### data.go.kr 판례 API (보조) 1. [data.go.kr](https://www.data.go.kr) 회원가입 → 인증키 복사
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The playbook explicitly requires output in Korean, which is a natural-language locale constraint. Under the policy, forcing a specific language without user opt-in is a reportable violation unless the regional constraint is clearly justified, which is not stated here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script reads a local API key from disk and immediately sends a user-supplied query to an external service without any disclosure or consent prompt. In an agent skill context, this can cause unintended transmission of user-provided legal queries and use of a sensitive credential, creating privacy, auditing, and secret-handling concerns even if the functionality is expected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script sends the API key as a query parameter over plain HTTP, so anyone on the network path can observe or modify the request and recover the credential. Because the response is then trusted and parsed, an active attacker could also tamper with legal content returned to the user, making this more dangerous in a law-search skill where integrity of retrieved statutes matters.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script reads a local API key from the user's home directory and transmits it to a third-party API without any disclosure or consent at runtime. In this skill context that behavior is expected for API-backed functionality, but it still creates a confidentiality risk because the secret is sent over an insecure channel and users are not informed that a local credential will be used.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script silently reads a local API credential from ~/.config/data-go-kr/api_key without any user-facing disclosure, which can violate least surprise and user consent expectations. In an agent skill context, undisclosed credential access is risky because users may not realize local secrets are being consumed on their behalf.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script sends both the user's legal query and the API key to a remote service without explicit disclosure, and it does so over plain HTTP. In a legal-search skill, user queries may contain sensitive personal legal issues, so undisclosed transmission increases privacy and credential-exposure risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file is primarily written in English, but the setup section switches to Korean for critical installation steps. This can impose a language/locale constraint on users without opt-in or an explicit statement that the skill is intended only for Korean-speaking users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The natural-language comments and argument error message are written only in Korean, which imposes a specific language on users without opt-in or documented justification. This is a language policy issue under the natural-language policy rule because the skill does not offer any locale choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language comments and user-visible error text are entirely in Korean, including usage guidance and runtime messages, with no indication that the skill is intentionally limited to Korean-speaking users. This can violate language/locale policy when no user opt-in or documented locale justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language comments, usage text, and runtime error messages are written only in Korean, which imposes a specific language without any opt-in or alternative. The policy calls for flagging language or locale constraints when the skill forces a specific language without user choice or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language strings in comments, usage text, and error messages are exclusively in Korean, with no indication that the skill is intentionally limited to Korean users or that language selection is supported. This can violate the language/locale policy when a specific language is imposed without opt-in or documented justification.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest describes a Korean law and case search skill, which justifies calling legal-information APIs, but it does not suggest local credential-file access as part of the skill's scope. Reading ~/.config/data-go-kr/api_key introduces a local filesystem capability beyond the user-facing legal-search purpose.
- Content
Static analysis
No suspicious patterns detected.