ClawHub
Back to skill

Security audit

국토부 부동산 실거래가

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent real-estate API purpose, but its included script can run unintended code if crafted arguments are passed to it.

Review this skill before installing. Its API-key setup and government data access are expected, but the bundled shell script should be fixed to validate inputs and pass them safely to Python before use, and the API key should be stored with restrictive permissions or in a secret store.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/real_estate.sh:6
Finding

Arbitrary Python Code Execution Through Unsafe Shell Argument Interpolation

Content
View full analysis
Remediation
View remediation
&2 exit 2 } [[ "$DEAL_YMD" =~ ^[0-9]{6}$ ]] || { echo "Invalid contract month: expected YYYYMM" >&2 exit 2 } year=${DEAL_YMD:0:4} month=${DEAL_YMD:4:2} (( 10#$month >= 1 && 10#$month <= 12 )) || { echo "Invalid contract month" >&2 exit 2 } [[ "$NUM" =~ ^[0-9]+$ ]] || { echo "Invalid row count: expected a positive integer" >&2 exit 2 } (( NUM >= 1 && NUM <= 1000 )) || { echo "Invalid row count: expected a value from 1 to 1000" >&2 exit 2 } python3 - "$LAWD_CD" "$DEAL_YMD" "$NUM" <<'PY' import json import sys import urllib.parse import urllib.request import xml.etree.ElementTree as ET from pathlib import Path lawd_cd, deal_ymd, num = sys.argv[1:4] key = (Path.home() / ".config/data-go-kr/api_key").read_text().strip() base = ( "https://apis.data.go.kr/1613000/" "RTMSDataSvcAptTrade/getRTMSDataSvcAptTrade" ) params = urllib.parse.urlencode({ "serviceKey": key, "LAWD_CD": lawd_cd, "DEAL_YMD": deal_ymd, "pageNo": "1", "numOfRows": num, }) url = f"{base}?{params}" with urllib.request.urlopen(url, timeout=15) as response: data = response.read().decode() root = ET.fromstring(data) items = root.findall(".//item") result = [] for item in items: result.append({ "aptNm": item.findtext("aptNm", "").strip(), "dealAmount": item.findtext("dealAmount", "").strip(), "excluUseAr": item.findtext("excluUseAr", "").strip(), "floor": item.findtext("floor", "").strip(), "buildYear": item.findtext("buildYear", "").strip(), "dealYear": item.findtext("dealYear", ""), "dealMonth": item.findtext("dealMonth", "") ...[truncated 1054 chars]

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents network access to external APIs and partner connectors, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a least-privilege gap: an agent may invoke broader network capabilities than the skill actually needs, increasing the chance of unintended outbound access or abuse through cross-skill/tool routing.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The setup instructions direct users to persist an API key in a predictable plaintext file under ~/.config/data-go-kr/api_key. Storing long-lived credentials unencrypted in a well-known location increases the risk of credential disclosure through local compromise, overbroad file permissions, backups, logs, or other tools that can read the home directory.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

  1. 로그인 → 마이페이지 → 일반 인증키(Decoding) 복사
  2. API 키 저장:
    bash
    mkdir -p ~/.config/data-go-kr
echo "YOUR_API_KEY" > ~/.config/data-go-kr/api_key
  3. 아래 서비스 활용신청 후 사용 (자동승인)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script reads an API key from a local credential file and includes it in an outbound HTTP request, but there is no confirmation prompt, warning message, or explanatory comment disclosing this sensitive operation to the user. For a code file, credential access and network transmission should have some visible disclosure unless clearly communicated elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file’s headings and preferences are entirely in Korean, which imposes a specific language on users through the skill content. There is no indication that the skill offers multilingual support, user opt-in, or that the Korean-only restriction is intentionally justified as region-specific policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.