naver-news-briefing

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:29 PM UTC
• Version:
  2026.4.16

Overview

This skill is a disclosed Naver News search and monitoring helper that stores Naver API credentials and local watch state for its stated purpose.

Install only if you are comfortable storing Naver Search API credentials and news monitoring queries in the skill's local data directory. Review generated cron/OpenClaw command text before enabling scheduled runs or forwarding output to external channels.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly instructs use of a CLI that stores credentials, reads and writes local state, and calls the Naver Search API, yet the skill metadata shown here declares no permissions. That mismatch is a real security issue because operators and policy systems cannot accurately assess or gate file and network access, increasing the chance of over-privileged or unexpected execution.

VirusTotal

54/54 vendors flagged this skill as clean.