Welfare Guide

육아/복지/정부지원금 스킬. 9개 인텐트 라우팅(Benefit Search~Beginner Guide), 보조금24+복지로 중앙/지자체 API 3-Layer 기반 맞춤형 혜택 조회. 트리거: "지원금", "복지", "혜택", "보조금", "육아", "출산", "보육료", "아동수당...

This skill appears to do what it says (tailored welfare/benefit lookup) but take these precautions before installing or using it: - Privacy: The skill will ask for personal details (age, household, income, disability, region) to provide tailored results. Avoid entering full identifiers (resident registration numbers, full addresses) and consider anonymizing sensitive values where possible. - API key handling: The setup instructs you to save a data.go.kr API key to ~/.config/data-go-kr/api_key in plaintext. Prefer storing keys in a secure secret manager or at least restrict file permissions (chmod 600). Do not paste credentials into chat messages. - Missing scripts: The playbook references bash scripts to call the APIs, but only a README is included — the actual scripts are not present. Before running anything, review or implement the scripts yourself to ensure they do exactly what you expect and do not exfiltrate data. - Web search fallback: If the APIs are not configured, the skill falls back to web_search. Be mindful that search queries may be logged by the search provider — avoid including sensitive personal data in those queries. - Verify scope: If you plan to supply an API key, confirm the data.go.kr service agreement and what data the APIs return; ensure the key has only the necessary permissions and monitor usage/quota. If you want to proceed: obtain a data.go.kr key, implement/review the missing scripts locally, store the key securely, and limit the personal data you supply in conversations. If you need, I can list exact checks to perform on any scripts before running them.

Type: OpenClaw Skill Name: welfare-guide Version: 1.0.1 The skill is classified as suspicious due to its explicit reliance on executing shell scripts (`welfare_central.sh`, `welfare_local.sh`, `subsidy24.sh`) with dynamic arguments, as indicated in `playbook.md` and `scripts/README.md`. While the actual script contents are not provided, the instruction to execute external shell commands with potentially user-derived input creates a significant remote code execution (RCE) vulnerability surface if the scripts lack proper input sanitization. Additionally, the skill is designed to read an API key from `~/.config/data-go-kr/api_key` for its operation, which, while intended for legitimate use, adds to the risk profile when combined with shell execution capabilities.