Security audit

Naver Blog Publisher

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Naver Blog publishing tool, but it asks users to run an unpinned third-party npm runner that can handle login, live publishing, and persistent local services.

Review this carefully before installing. Treat publish_live as a real post to your Naver Blog account, avoid running the unpinned npx commands unless you trust the package source and current release, and ask for pinned versions, integrity verification, explicit live-publish confirmation, and documented service uninstall steps.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

Location: SKILL.md:73
Finding: Persistent Service Installation Through Automatic Runner Setup
Content: View full analysis
" --auto-service both ``` ```bash npx @y80163442/naver-thin-runner setup \ --proof-token "" \ --setup-issue-url "" \ --auto-service both ``` ### Technical Analysis The documented setup procedure passes `--auto-service both` to an externally supplied runner. This explicitly requests automatic service installation, causing runner-controlled components to survive beyond the initiating Skill execution and operate across user sessions. The repository contains no implementation for the runner, no description of the services installed, no service definitions, and no documented uninstall procedure. Consequently, the audit cannot verify the resulting services' executable paths, privileges, startup conditions, network behavior, update mechanism, or access to browser authentication data. Although persistent operation may support the advertised local publishing workflow, enabling it automatically without documenting its exact scope or requiring separate informed approval violates least-persistence principles. The service may retain access to the local publishing interface and authentication state after the original task has ended. ### Attack Path 1. An agent or user follows the setup instructions in `SKILL.md`. 2. `npx` retrieves and executes `@y80163442/naver-thin-runner`. 3. The package processes the `--auto-service both` argument. 4. Runner-controlled service components are registered to start automatically. 5. Those components persist after the setup command and originating agent session terminate. 6. If the retrieved package is malicious or later compromised, its persistent components can continue operating within the privileges of the account that performed setup. ### Impact Asse ...[truncated 553 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:73
Finding: Execution of an Unpinned Third-Party npm Package
Content: View full analysis
" --auto-service both ``` ```bash npx @y80163442/naver-thin-runner setup \ --proof-token "" \ --setup-issue-url "" \ --auto-service both ``` ```bash npx @y80163442/naver-thin-runner login ``` ```bash npx @y80163442/naver-thin-runner daemon start --port 19090 ``` ### Technical Analysis Every setup, login, and daemon command invokes `npx` with the bare package name `@y80163442/naver-thin-runner`. No exact version, lockfile, integrity digest, reviewed source copy, or provenance-verification procedure is supplied. As a result, execution is not bound to the package version that existed when the Skill was reviewed. Package behavior can change independently of this repository. A compromised package publisher account, malicious future release, or upstream registry compromise could therefore replace the effective local payload without modifying `SKILL.md`. The dependency is executed in security-sensitive contexts: setup receives a setup URL or proof token, login interacts with an authenticated browser workflow, and the daemon participates in live publishing. The package is also authorized to install automatic services. These capabilities substantially increase the consequences of a supply-chain compromise. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, or relevant package distribution channel. 2. The attacker publishes a malicious version under the existing package name. 3. A user or agent executes one of the documented unversioned `npx` commands. 4. `npx` resolves and runs the externally supplied package version rather than a previously audited immutable artifact. 5. The package executes with the invoking user's permissions and recei ...[truncated 990 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill enables live publishing to an external Naver Blog account but does not present a prominent explicit warning that publish_live will modify user-controlled external content. This omission increases the risk of accidental publication, unwanted content changes, or misuse by downstream agents that may treat the action as low-risk despite it having real-world side effects.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs users to execute an npm package via npx without pinning a specific version, which allows whatever version is current at execution time to run with the user's local privileges. Because this package performs setup, login, and daemon operations on the buyer's machine, a malicious or compromised upstream release could directly steal credentials, alter browser/session state, or execute arbitrary code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This command again invokes an unpinned npm package through npx, creating a supply-chain risk where future package changes are implicitly trusted at runtime. In this skill's context, the command handles proof/setup flows tied to a local authenticated publishing runner, so compromise could expose tokens, install persistence, or hijack the publishing path.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The one-time login command depends on the latest package version at execution time, which is dangerous because login flows often interact with sensitive browser sessions and credentials. If the package is compromised upstream, users may unknowingly run attacker-controlled code during authentication, increasing the chance of credential theft or account takeover.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Starting a local daemon from an unpinned package introduces the same supply-chain risk, but here the impact may include long-lived local service execution and persistence on the user's machine. In a daemon context, attacker-controlled code could open listening services, exfiltrate local data, or manipulate future publish operations beyond a single command execution.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.