MIJ Kakao Local API (PowerShell)

PowerShell skill for calling Kakao Local API to normalize addresses and search places with keyword, location, radius, and category filters.

This skill implements a Kakao Local API client in PowerShell and requires a Kakao REST API key, but the package metadata omits that requirement — treat that as a red flag. Before installing: (1) verify you obtain and store a Kakao REST API key with appropriate scope and rotate/revoke it if compromised; (2) prefer setting the key as a User-scoped environment variable rather than committing a config.json into source control (the SKILL.md also warns to add config.json to .gitignore); (3) review and control files under skills/kakao-local/data (places.json, cache.json) because they may contain saved locations or query history; (4) run the script in a constrained/test environment (or with a limited account) first to confirm behavior; and (5) ask the publisher to update registry metadata to declare KAKAO_REST_API_KEY as a required credential so automated gating and audits can catch it.

Type: OpenClaw Skill Name: mij-kakao-local Version: 1.0.0 The skill is classified as suspicious due to its reliance on `curl.exe` (an external executable) for making API calls, where user-controlled input (`-Query` parameter) is incorporated into the command line. While the script attempts to mitigate shell injection risks by URL-encoding parameters using `[System.Uri]::EscapeDataString` and hardcoding the API endpoints to Kakao domains, the execution of an external binary with user-derived input still presents a potential vulnerability surface for command injection, even if mitigated. There is no evidence of intentional malicious behavior such as data exfiltration to arbitrary endpoints, persistence mechanisms, or prompt injection attempts in `SKILL.md`. Local file system access is confined to the skill's `data/` directory for legitimate purposes like configuration and caching.