한국 연금/노후 설계

연금/노후설계 스킬. 9개 인텐트 라우팅(National Pension~Beginner Guide), 국민연금 예상 수령액 계산 + IRP/연금저축 절세 비교 + 노후 자금 역산 시뮬레이터. 트리거: "국민연금", "예상 수령액", "연금저축", "IRP", "퇴직금", "노후 준...

What to consider before installing/use: - Do not provide sensitive personal identifiers (예: 주민등록번호) or run scripts unless you can inspect them first. The playbook shows a command that would take a 주민번호 fragment but the actual script is not included for review — that is a red flag. - The skill references local binaries (~/.npm-global/bin/yf) and mentions enabling an API key, but no required binaries or environment variables are declared. Ask the author to list exact dependencies and any environment variables or keys needed. - Before running any referenced script, request the script source (nps_query.sh). If the script will be run by the agent, review its contents for network calls, logging, or exfiltration of data. - Prefer the skill to rely on official public sites for sensitive personal data (it already recommends 내연금/csa.nps.or.kr). If you need precise estimates, use the official site rather than handing PII to a third-party skill. - Ask the publisher to: (1) provide missing scripts or remove scripts that request PII, (2) declare required binaries and environment variables, and (3) clarify connector names/syntax (SKILL.md shows odd tildes ~~, which may be a formatting error). If the author supplies the missing script(s) and a clear explanation of when and how personal identifiers are used (and no undeclared credentials are required), this assessment could be downgraded to benign. Conversely, if the skill actually includes a script that collects or transmits resident registration numbers or requires undeclared secrets, treat it as high-risk and avoid installing.

Type: OpenClaw Skill Name: pension-guide Version: 1.0.0 The skill bundle is classified as suspicious due to the presence of direct shell command execution and a commented-out instruction indicating potential handling of highly sensitive PII via a local script. The `playbook.md` file explicitly instructs the agent to execute `~/.npm-global/bin/yf quote` commands, demonstrating a direct shell execution capability which is a vulnerability (e.g., shell injection risk if inputs are not sanitized). Furthermore, `playbook.md` contains a commented-out line `# bash skills/pension-guide/scripts/nps_query.sh "[주민번호 앞자리]"`, which, even if inactive, suggests a design consideration for passing sensitive resident registration number prefixes to a local script, posing a significant PII handling risk.