{"data":{"skill":{"slug":"nomadamas-korean-patent-search","name":"korean-patent-search","icon":"📦","repo":"https://github.com/nomadamas/k-skill/tree/9766d20fb1fe1a5eb1d10ef5ff9872c8d6fc4985/korean-patent-search","status":"approved","author":"nomadamas","authorVersion":null,"skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"c7c7415f-e61c-4402-9614-ee2923be2856","skill_id":"053aff81-637e-491a-802d-fabbf4c840a3","version":1,"content_hash":"v3:9938f91a9ab0f5763a54332b129295339bf829dd:d8788592ace7397e8bf8a9f5d8b4bbab24aad8bb25d6a65974d68b5bddcdfeb1:95274ae18e67c4e358341bb0b976b20a7d69d7f3a8fe81c6724ea3a5101bcde8:736b696c6c732f6e6f6d6164616d61732f6b6f7265616e2d706174656e742d736561726368:0693e55c1a01d114c56d30333c9dc743","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Twenty static findings are false positives involving credential names, ordinary HTTPS access, Markdown delimiters, version strings, error messages, and readable Korean documentation. Three command examples create supply-chain or scope risks through unattended npm execution and broad skill updates. No evidence found of credential theft, malicious prompt injection, or obfuscated executable content in the reviewed files.","remediation":[{"issue":"SKILL.md instructs unattended execution of a mutable npm package for instructions and file listings.","severity":"medium","suggestion":"Prefer the reviewed local instructions and helper. Otherwise, pin a reviewed exact package version, verify integrity, and obtain approval before external execution."},{"issue":"The recommended update command affects the CLI and unrelated coding-agent skill installations.","severity":"medium","suggestion":"Remove blanket updates from this search workflow. Offer narrowly scoped updates only after explicit approval and a clear description of affected installations."}],"risk_factor_evidence":[{"factor":"env_access","evidence":[{"file":"instruction.md","line_end":26,"line_start":26},{"file":"instruction.md","line_end":44,"line_start":44},{"file":"instruction.md","line_end":53,"line_start":53},{"file":"instruction.md","line_end":62,"line_start":62},{"file":"instruction.md","line_end":71,"line_start":71},{"file":"scripts/patent_search.py","line_end":128,"line_start":128},{"file":"scripts/patent_search.py","line_end":128,"line_start":128},{"file":"scripts/patent_search.py","line_end":15,"line_start":15}]},{"factor":"network","evidence":[{"file":"scripts/patent_search.py","line_end":9,"line_start":9},{"file":"scripts/patent_search.py","line_end":172,"line_start":172},{"file":"scripts/patent_search.py","line_end":174,"line_start":174},{"file":"scripts/patent_search.py","line_end":19,"line_start":19},{"file":"scripts/patent_search.py","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":35,"line_start":35}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":21,"line_start":19},{"file":"SKILL.md","line_end":25,"line_start":21},{"file":"SKILL.md","line_end":27,"line_start":25},{"file":"SKILL.md","line_end":31,"line_start":27},{"file":"SKILL.md","line_end":33,"line_start":31},{"file":"SKILL.md","line_end":35,"line_start":33}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":21,"line_start":19}],"confidence":0.94,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example runs npx -y with a mutable major-version package selector and delegates primary instructions to its output. Unreviewed package execution and changing instructions create supply-chain exposure, although the Markdown fence is not shell substitution."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":27,"line_start":25}],"confidence":0.92,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The files example still executes npx -y @nomadamas/k-skill@0, potentially downloading and running a changing package without confirmation. An informational command name does not remove this package-execution risk."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":33,"line_start":31}],"confidence":0.96,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The update example executes a mutable npm package and is described as updating every coding-agent skill installation. This expands beyond patent search and risks unintended changes to unrelated installations."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":4,"total_lines":542,"audit_model":"codex","audited_at":"2026-11-08T14:42:36.29+00:00","created_at":"2026-11-09T16:02:02.050926+00:00","static_findings":[{"id":"env_access:instruction.md:26:generic-api-secret-keys","file":"instruction.md","pattern":"Generic API/secret keys","snippet":"- helper 환경변수: `KIPRIS_PLUS_API_KEY`","category":"env_access","line_end":26,"severity":"high","line_start":26},{"id":"env_access:instruction.md:44:generic-api-secret-keys","file":"instruction.md","pattern":"Generic API/secret keys","snippet":"1. `KIPRIS_PLUS_API_KEY` 또는 `--service-key` 로 ServiceKey를 확보한다. 공공데이터포털에서 복사한 percent-encoded 값도 hel","category":"env_access","line_end":44,"severity":"high","line_start":44},{"id":"env_access:instruction.md:53:generic-api-secret-keys","file":"instruction.md","pattern":"Generic API/secret keys","snippet":"export KIPRIS_PLUS_API_KEY=your-service-key","category":"env_access","line_end":53,"severity":"high","line_start":53},{"id":"env_access:instruction.md:62:generic-api-secret-keys","file":"instruction.md","pattern":"Generic API/secret keys","snippet":"- 키가 없으면 `KIPRIS_PLUS_API_KEY` 또는 `--service-key` 를 정확히 안내한다.","category":"env_access","line_end":62,"severity":"high","line_start":62},{"id":"env_access:instruction.md:71:generic-api-secret-keys","file":"instruction.md","pattern":"Generic API/secret keys","snippet":"- 에러 시 `KIPRIS_PLUS_API_KEY` / `ServiceKey` 관련 안내가 분명하다.","category":"env_access","line_end":71,"severity":"high","line_start":71},{"id":"network:scripts/patent_search.py:9:python-http-libraries","file":"scripts/patent_search.py","pattern":"Python HTTP libraries","snippet":"import urllib.request","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:scripts/patent_search.py:172:python-http-libraries","file":"scripts/patent_search.py","pattern":"Python HTTP libraries","snippet":"request = urllib.request.Request(request_url, headers=DEFAULT_HEADERS)","category":"network","line_end":172,"severity":"low","line_start":172},{"id":"network:scripts/patent_search.py:174:python-http-libraries","file":"scripts/patent_search.py","pattern":"Python HTTP libraries","snippet":"with urllib.request.urlopen(request, timeout=timeout) as response:","category":"network","line_end":174,"severity":"low","line_start":174},{"id":"network:scripts/patent_search.py:19:hardcoded-url","file":"scripts/patent_search.py","pattern":"Hardcoded URL","snippet":"BASE_API_URL = \"https://plus.kipris.or.kr/kipo-api/kipi/patUtiModInfoSearchSevice\"","category":"network","line_end":19,"severity":"low","line_start":19},{"id":"network:scripts/patent_search.py:26:hardcoded-ip-address","file":"scripts/patent_search.py","pattern":"Hardcoded IP address","snippet":"\"AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\"","category":"network","line_end":26,"severity":"medium","line_start":26},{"id":"env_access:scripts/patent_search.py:128:python-getenv-function","file":"scripts/patent_search.py","pattern":"Python getenv function","snippet":"candidate = clean_text(explicit_key) or clean_text(os.getenv(SERVICE_KEY_ENV_VAR))","category":"env_access","line_end":128,"severity":"low","line_start":128},{"id":"env_access:scripts/patent_search.py:128:getenv-function-call","file":"scripts/patent_search.py","pattern":"getenv function call","snippet":"candidate = clean_text(explicit_key) or clean_text(os.getenv(SERVICE_KEY_ENV_VAR))","category":"env_access","line_end":128,"severity":"low","line_start":128},{"id":"env_access:scripts/patent_search.py:15:generic-api-secret-keys","file":"scripts/patent_search.py","pattern":"Generic API/secret keys","snippet":"SERVICE_KEY_ENV_VAR = \"KIPRIS_PLUS_API_KEY\"","category":"env_access","line_end":15,"severity":"high","line_start":15},{"id":"blocker:scripts/patent_search.py:293:system-reconnaissance","file":"scripts/patent_search.py","pattern":"System reconnaissance","snippet":"raise RuntimeError(\"KIPRIS Plus detail response did not include an item payload\")","category":"blocker","line_end":293,"severity":"low","line_start":293},{"id":"blocker:scripts/patent_search.py:132:network-reconnaissance","file":"scripts/patent_search.py","pattern":"Network reconnaissance","snippet":"f\"missing {SERVICE_KEY_ENV_VAR}. Export {SERVICE_KEY_ENV_VAR} or pass --service-key \"","category":"blocker","line_end":132,"severity":"low","line_start":132},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":21,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":25,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":27,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":31,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":33,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":35,"severity":"medium","line_start":33},{"id":"network:SKILL.md:35:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"If `npx` is unavailable, install Node.js 18+ or follow https://github.com/NomaDamas/k-skill#readme, ","category":"network","line_end":35,"severity":"low","line_start":35},{"id":"obfuscation:instruction.md:1:heuristic-high-file-entropy-6-21-bits-possible-b","file":"instruction.md","pattern":"[HEURISTIC] High file entropy (6.21 bits) - possible binary/encrypted content","snippet":"File: instruction.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"env_access:instruction.md:26:generic-api-secret-keys","reason":"This documents the required environment variable name, not a credential value. The helper uses it for the intended KIPRIS Plus authentication.","verdict":"false_positive","confidence":0.99},{"id":"env_access:instruction.md:44:generic-api-secret-keys","reason":"The workflow describes obtaining the user-provided ServiceKey and normalizing percent encoding. It does not disclose a secret or request unrelated credentials.","verdict":"false_positive","confidence":0.98},{"id":"env_access:instruction.md:53:generic-api-secret-keys","reason":"The export example contains the literal placeholder your-service-key, not a live credential. No secret is embedded in this line.","verdict":"false_positive","confidence":1},{"id":"env_access:instruction.md:62:generic-api-secret-keys","reason":"This instructs the agent to explain configuration when the required key is missing. It neither accesses additional secrets nor directs credential disclosure.","verdict":"false_positive","confidence":0.99},{"id":"env_access:instruction.md:71:generic-api-secret-keys","reason":"This completion criterion requires clear API-key configuration guidance on errors. It names authentication fields without including credential values.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/patent_search.py:9:python-http-libraries","reason":"urllib.request is the standard HTTP client used for the documented patent API. The import itself performs no network activity.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/patent_search.py:172:python-http-libraries","reason":"The request encodes search parameters and the intended ServiceKey for the fixed official HTTPS API endpoint. No unrelated data collection or destination appears.","verdict":"false_positive","confidence":0.98},{"id":"network:scripts/patent_search.py:174:python-http-libraries","reason":"urlopen fetches the requested KIPRIS Plus XML with a configured timeout. The reviewed callers construct official API URLs rather than arbitrary user-supplied destinations.","verdict":"false_positive","confidence":0.98},{"id":"network:scripts/patent_search.py:19:hardcoded-url","reason":"The fixed HTTPS URL is the documented KIPRIS Plus patent and utility-model API endpoint. It supports the stated search functionality, not an unrelated collection service.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/patent_search.py:26:hardcoded-ip-address","reason":"136.0.0.0 is a Chrome version inside the User-Agent string, not a network destination. The request destination comes from BASE_API_URL.","verdict":"false_positive","confidence":1},{"id":"env_access:scripts/patent_search.py:128:python-getenv-function","reason":"The helper reads only KIPRIS_PLUS_API_KEY as the documented fallback to an explicit ServiceKey. It does not enumerate the environment or collect unrelated secrets.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/patent_search.py:128:getenv-function-call","reason":"This duplicates the same narrow environment lookup for legitimate API authentication. The resolved key is passed to the intended KIPRIS Plus request.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/patent_search.py:15:generic-api-secret-keys","reason":"SERVICE_KEY_ENV_VAR contains an environment variable name, not a secret value. Defining this constant does not access credentials.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/patent_search.py:293:system-reconnaissance","reason":"This raises an error when the API detail response lacks an item payload. It performs no host inspection or system reconnaissance.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/patent_search.py:132:network-reconnaissance","reason":"This string explains how to configure a missing ServiceKey. It performs no network probing, enumeration, or reconnaissance.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The fenced example runs npx -y with a mutable major-version package selector and delegates primary instructions to its output. Unreviewed package execution and changing instructions create supply-chain exposure, although the Markdown fence is not shell substitution.","verdict":"confirmed","severity":"medium","confidence":0.94},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"These matched backticks close and open Markdown code blocks around explanatory prose. They are not executable shell substitution; the actual command risks are adjudicated separately.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The files example still executes npx -y @nomadamas/k-skill@0, potentially downloading and running a changing package without confirmation. An informational command name does not remove this package-execution risk.","verdict":"confirmed","severity":"medium","confidence":0.92},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The matched delimiters are Markdown fences around update guidance, not shell backtick execution. The actual update invocation is evaluated under its own finding.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The update example executes a mutable npm package and is described as updating every coding-agent skill installation. This expands beyond patent search and risks unintended changes to unrelated installations.","verdict":"confirmed","severity":"medium","confidence":0.96},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The backticks terminate a Markdown example, followed by fallback setup links. This location contains no additional shell substitution or executable command.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:35:hardcoded-url","reason":"These GitHub URLs reference the author's setup documentation and source instructions. The links themselves neither execute code nor transmit credentials.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:instruction.md:1:heuristic-high-file-entropy-6-21-bits-possible-b","reason":"The file is readable Korean and English Markdown describing API usage and examples. Its multilingual text explains the entropy signal; no evidence found of encrypted or binary payloads.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"9938f91a9ab0f5763a54332b129295339bf829dd","subject_content_hash":"d8788592ace7397e8bf8a9f5d8b4bbab24aad8bb25d6a65974d68b5bddcdfeb1","subject_tree_hash":"95274ae18e67c4e358341bb0b976b20a7d69d7f3a8fe81c6724ea3a5101bcde8","subject_plugin_path":"skills/nomadamas/korean-patent-search","audit_payload_hash":"0693e55c1a01d114c56d30333c9dc743","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"9938f91a9ab0f5763a54332b129295339bf829dd","contentHash":"d8788592ace7397e8bf8a9f5d8b4bbab24aad8bb25d6a65974d68b5bddcdfeb1","treeHash":"95274ae18e67c4e358341bb0b976b20a7d69d7f3a8fe81c6724ea3a5101bcde8","pluginPath":"skills/nomadamas/korean-patent-search","auditPayloadHash":"0693e55c1a01d114c56d30333c9dc743"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/nomadamas-korean-patent-search/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}