OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail4 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill fetches Korean postcode data from the official ePost website. However, the implementation is vulnerable to a local file inclusion attack because it uses curl's --data-urlencode flag with unvalidated user input. This could allow an attacker to read sensitive files from the system and transmit them to the external ePost server.
Detected behaviors
No alerts
No issues
Score: 93/100 · 2 sections analyzed