Naver Writer ACP

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:10 AM UTC
• Version: 1.1.1

Overview

This skill mostly matches its Naver Blog publishing purpose, but it asks users to run unpinned remote runner code and includes privileged admin fallback paths that should be reviewed before installation.

Install only if you trust the publisher and the npm runner package, understand that setup may run externally fetched code locally, and can ensure `OPENCLAW_OFFERING_EXECUTE_URL`, setup URLs, and any API keys point only to trusted HTTPS services. Avoid using or exposing the admin fallback in normal publishing flows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/setup_runner.sh:44

Finding

Unpinned Third-Party Package Is Downloaded and Executed

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/publish.sh:145

Finding

Sensitive Requests Can Be Sent to Unvalidated Environment-Controlled Destinations

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents shell command execution but does not declare any explicit tool scope or allowed-tools boundary. That increases the chance an agent will invoke shell capabilities unexpectedly or more broadly than intended, which is risky in a skill that handles local daemons, tokens, and publishing actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The activation description is broad enough to match common requests like writing or publishing a post, setup recovery, or login help without tightly constraining when this commerce-connected skill should run. In context, that matters because the skill can trigger local shell actions, onboarding flows, and paid execution paths, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using npx @y80163442/naver-thin-runner login without a pinned version allows the latest package version to be fetched at execution time, creating a supply-chain risk. If the package is compromised or a breaking/malicious update is published, the skill could execute untrusted code on the buyer's local machine.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation describes a fallback to direct /v2/jobs/dispatch-and-wait even though the skill is presented as a marketplace-mediated paid publishing flow. This creates a scope-expansion path that could bypass normal offering controls, billing, policy enforcement, or approval boundaries if an agent or operator uses the fallback.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Mentioning ACP_ADMIN_API_KEY for internal debugging exposes the existence of privileged administrative capability in a user-facing skill context unrelated to ordinary Naver publishing. Even without the key value present, this can encourage misuse, increase attack surface, and blur separation between customer and admin operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown exposes an internal fallback path that uses ACP_ADMIN_API_KEY but does not prominently warn that this is a highly sensitive administrative credential. In a skill meant for publication workflows, casually documenting an admin key increases the chance of misuse, unsafe storage, leakage into logs/shell history, or accidental use of a privileged path outside intended ops contexts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The setup instructs users to run npx @y80163442/naver-thin-runner without pinning an exact package version. This creates a supply-chain risk: a later malicious or compromised package release could be fetched and executed automatically in a workflow that appears to handle login and publishing, likely with access to tokens and browser/session state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script constructs a JSON payload containing PROOF_TOKEN and DEVICE_FINGERPRINT and sends it via curl to SETUP_ISSUE_URL. There is no confirmation prompt, visible log/print statement, or explanatory comment/docstring disclosing that potentially sensitive identifiers are being transmitted.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/preflight.sh (reported line 71)May include surrounding context.

sh

local code
  code="$({
    curl -sS -o "$tmp_body" -w '%{http_code}' \
      -X POST \
      -H 'content-type: application/json' \
      -d "$payload" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script collects blog content, runner attestation, sealed payload metadata, and idempotency data, then transmits them to local and remote services without any explicit disclosure or consent mechanism in the script. In this skill context, the transmission is expected for publishing, but the lack of clear trust-boundary signaling increases the risk of unintended data handling and makes misuse harder for operators to detect.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish.sh (reported line 119)May include surrounding context.

sh

)"

seal_code="$({
  curl -sS -o "$seal_tmp" -w '%{http_code}' \
    -X POST \
    -H 'content-type: application/json' \
    -H "x-local-token: ${X_LOCAL_TOKEN}" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 79% confidence

Finding

This code transmits execution requirements, including attestation and sealed payload data, to a remote endpoint with an API key, but performs no validation of the destination URL or enforcement of HTTPS. If the endpoint is misconfigured or attacker-controlled via environment variables, sensitive job metadata could be sent to an untrusted service.

Content

Scanner excerpt · scripts/publish.sh (reported line 158)May include surrounding context.

sh

if [[ -n "$OFFERING_API_KEY" ]]; then
    execute_code="$({
      curl -sS -o "$exec_tmp" -w '%{http_code}' \
        -X POST \
        -H 'content-type: application/json' \
        -H "${OFFERING_API_KEY_HEADER}: ${OFFERING_API_KEY}" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

This branch sends the same execution payload to a remote endpoint without any authentication header when OFFERING_API_KEY is absent. That increases the chance of accidental disclosure to an unintended service and could allow unauthenticated submission to any endpoint supplied through configuration.

Content

Scanner excerpt · scripts/publish.sh (reported line 167)May include surrounding context.

sh

} || true)"
  else
    execute_code="$({
      curl -sS -o "$exec_tmp" -w '%{http_code}' \
        -X POST \
        -H 'content-type: application/json' \
        -d "$execute_body" \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script contains a fallback path that bypasses the stated marketplace/offering execute flow and instead submits jobs directly to the control plane using an admin API key. That creates a privilege-boundary violation: anyone able to run this script with those environment variables can dispatch jobs with elevated authority, increasing the blast radius of misconfiguration, abuse, or secret leakage.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This POST sends job requirements to the control plane using an admin API key, which is a highly privileged credential. If the URL or environment is compromised, the script could disclose a powerful secret and allow unauthorized job dispatches or broader administrative abuse.

Content

Scanner excerpt · scripts/publish.sh (reported line 190)May include surrounding context.

sh

fi

dispatch_code="$({
  curl -sS -o "$exec_tmp" -w '%{http_code}' \
    -X POST \
    -H 'content-type: application/json' \
    -H "x-api-key: ${ADMIN_KEY}" \

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The script invokes npx @y80163442/naver-thin-runner setup without pinning an exact package version, so execution depends on whatever version is currently resolved from the registry. In a setup flow that handles onboarding and credential-adjacent operations, this creates a supply-chain risk: a compromised publisher account, malicious update, or dependency takeover could cause arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script executes externally fetched package code via npx during a setup path without any confirmation, trust prompt, or safety warning. Because this skill is specifically designed to bootstrap a local runner for paid-service execution and onboarding recovery, the command is likely to be run on an end-user machine with meaningful local access, making silent remote code execution through package resolution especially dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script forwards PROOF_TOKEN, SETUP_ISSUE_URL, and DEVICE_FINGERPRINT to an external package command with no user-facing disclosure or consent checkpoint in the file. In this skill's context, those values are part of an onboarding and device-binding flow, so silently transmitting them to remotely sourced code increases privacy, tracking, and token-misuse risk if the package or its telemetry behavior is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The echoed next-step guidance tells the user to run npx @y80163442/naver-thin-runner login without a pinned version, extending the same unpinned supply-chain risk into the manual login step. Even though this line is not immediate execution by the script, it operationalizes insecure instructions that may lead users to run arbitrary updated code later.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file includes operational guidance such as 'Internal fallback only' and 'Use only for debugging/ops' but does not clearly define when this path should be used versus avoided beyond a brief note. Because SQP-1 applies to markdown files, this ambiguous activation condition can lead to unintended use of the fallback path.

Content

No source excerpt is available for this finding.