mij-kakao-local

clawhub:mij-kakao-local

View source
B
85/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

2

Score

85/100

HIGH 1
LOW 1

Findings (2)

HIGH
Zero-width character obfuscation
L1

Detects zero-width characters used to hide content


FIX

Remove hidden directives embedded in markdown, HTML comments, or encoded text. All agent-facing text should be explicit and visible in the skill definition.

FP?

Likely FP if the match is a standard markdown formatting pattern or HTML comment used for documentation rather than concealing directives.

LOW
Runtime URL controlling behavior
L54

Detects URLs fetched at runtime that control or influence agent behavior without pinning

GET https:// + Config
FIX

Avoid loading configuration or behavior-controlling content from runtime URLs. Bundle required configurations locally or pin remote config to versioned, integrity-verified endpoints.

FP?

Likely FP if the URL in the match is a documentation link or example URL (e.g., example.com) rather than an actual runtime-fetched configuration endpoint.