Back to skill

Security audit

Naver Real Estate Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Korean real-estate search and monitoring helper that stores local cache/watch data for its stated purpose.

Install only if you are comfortable with the skill querying Naver and retaining local property-search cache/watch data in its data and references JSON files. Use preview modes before applying generated seeds, and clear the cache/watch files on shared machines if property interests are sensitive.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Env Variable Harvesting

High
Category
Data Exfiltration
Content
elif query_alias and query_alias in normalized_name:
        score += 85

    for token in keyword_tokens:
        if token == name:
            score += 120
        elif token in name:
Confidence
80% confidence
Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
for token in keyword_tokens:
        if token == name:
            score += 120
        elif token in name:
            score += 55
        elif token in address:
            score += 22
Confidence
80% confidence
Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
for token in keyword_tokens:
        if token == name:
            score += 120
        elif token in name:
            score += 55
        elif token in address:
            score += 22
Confidence
80% confidence
Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documents capabilities that read and write local files and perform network access, but it does not declare any explicit tool scope or permissions boundary. That omission can let an agent invoke broader-than-expected actions, increasing the chance of unintended file modification, persistence, or external requests without clear operator awareness.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The skill states '한국어 브리핑 우선' and directs the chat surface to provide Korean interpretation first, which is a language-choice constraint expressed in natural language. There is no indication that the user can choose another language or opt into Korean output, so this conflicts with the language/locale policy criteria.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
This code generates all natural-language headlines, summaries, help text, and parser description in Korean. Because the skill does not provide a user opt-in or alternative locale, it appears to enforce a specific language, which matches the policy-violation category for language or locale constraints.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
Natural-language messages, help text, and output strings in this file are written in Korean, and the skill does not offer a user language or locale option. That can violate language/locale policy when a skill forces a specific language without user opt-in.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script maintains persistent local state in JSON files such as candidate-cache.json and watch-rules.json, and mutates that state during normal operations via functions like remember_candidate() and seed_candidate_cache(). While this is not code-execution or credential theft, it does create undeclared persistence of user-derived data and expands the skill from a transient search tool into a stateful collector, which can surprise users and create privacy or integrity issues if shared across sessions or users.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The _write_json_file() path writes candidate cache data to disk automatically without any user-facing notice, consent, or runtime indication. This is dangerous because search terms, inferred property interests, and candidate complex metadata may persist locally beyond the user's expectation, creating privacy leakage and possible cross-user data exposure on shared systems.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
This code includes user-facing descriptions and output strings entirely in Korean, including the CLI description and preview/help text. The skill does not offer any language selection or document that it is intentionally limited to Korean users, which creates a language/locale policy issue under the stated rules.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The skill describes commands that update seed files, cache files, and watch-rule storage, but it does not prominently warn that these operations modify local state. In an agent setting, that can cause silent persistence or configuration drift if the model executes examples as normal workflow rather than after explicit user approval.

Natural-Language Policy Violations

Low
Confidence
76% confidence
Finding
This JSON file contains user-facing entity names and aliases exclusively in Korean, along with a Korean address, but provides no indication that the skill is region-specific or that users can opt into this locale. Under the policy for natural-language violations, fixed locale assumptions can be a concern when not clearly documented or optional.

Natural-Language Policy Violations

Low
Confidence
92% confidence
Finding
This JSON includes user-visible natural-language content in Korean, such as notes and status text, with no accompanying indication that the skill is Korean-only or that users can opt into this locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
The embedded error message is presented only in Korean and appears intended for user consumption, but the file does not document that the skill is restricted to Korean-language users or provide a language choice. This creates a language-policy concern for users expecting language neutrality or opt-in.

Natural-Language Policy Violations

Low
Confidence
90% confidence
Finding
The policy strings are written entirely in Korean and specify operational rules, but the file does not indicate that Korean is an intentional, justified locale requirement or provide any language/locale option. Under the policy-violation criteria, forcing a specific language without opt-in can be a natural-language policy issue.

Natural-Language Policy Violations

Low
Confidence
78% confidence
Finding
This JSON file contains only Korean natural-language text in the top-level description and several note fields, with no indication that the skill offers language choice or that the locale restriction is explicitly justified. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.