v2026.4.16

Naver Real Estate Search

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 7:41 AM.

Analysis

This skill appears aligned with searching and monitoring Naver real-estate listings, but users should notice its local scraper dependency, external Naver requests, and saved watch/cache files.

GuidanceBefore installing, confirm you are comfortable with Naver receiving your property search terms, inspect or pin the referenced local naverland-scrapper dependency, and periodically review the local watch-rules and candidate-cache files if they contain sensitive preferences.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

이 스킬은 로컬 upstream clone을 래핑한다. - `tmp/naverland-scrapper`

The skill discloses reliance on a local upstream scraper clone that is not part of the manifest or install metadata, so its exact version/provenance is outside the packaged artifacts.

User impactThe skill's behavior may depend on code in a local scraper checkout that the user should trust and inspect separately.

RecommendationUse a trusted, pinned upstream source or include/declare the dependency with a commit, homepage, and reviewable install instructions.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

scripts/build_candidate_seeds.py

SEARCH_URL = "https://search.naver.com/search.naver?...&query={query}" ... html = sre._request_text(url)

The code sends search strings to Naver and retrieves web content, which is expected for a Naver real-estate search skill but means search terms leave the local environment.

User impactNaver may receive property-search terms such as neighborhoods, complexes, and possibly price preferences.

RecommendationAvoid including unnecessary personal details in queries, and prefer direct complex IDs/URLs when minimizing broad search exposure matters.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

SKILL.md

로컬 JSON 파일에 watch rule 저장 ... `last_seen` / `events` / dedupe ... 저장 파일: `data/watch-rules.json`, `data/candidate-cache.json`, `references/candidate-seeds.json`

The skill intentionally persists watch criteria, observed listings, and candidate aliases in local JSON files that can influence future alerts and search results.

User impactSaved search rules and cache entries can reveal real-estate interests and, if inaccurate, can affect later results.

RecommendationReview or clear the local JSON files when needed, and preview generated seed changes before using apply-target or apply-cache.