mfds-food-safety
What this skill does
Public health food safety check using Korean government APIs, with an emphasis on user interview before querying food safety data.
github/nomadamas - Insecure API Key Handling - 7.1k stars
Threat analysis
Skill info
pkg:github/NomaDamas/k-skill@44fbaca?skill=mfds-food-safetyAssessments (3)
Insecure API Key Handling
Insecure API Key Handling via local-llm-review
instruction.md
DATA_GO_KR_API_KEY and FOODSAFETYKOREA_API_KEY are stored in environment variables and used for live data queries. These keys are sensitive and should be protected.Insecure Proxy Configuration
Insecure Proxy Configuration via local-llm-review
instruction.md
The proxy base URL is configurable via environment variable KSKILL_PROXY_BASE_URL. If not properly secured, this could be exploited to route traffic through malicious proxies.Potential Misuse of Proxy
Potential Misuse of Proxy via local-llm-review
scripts/mfds_food_safety.py
The script uses a proxy base URL that could be manipulated if not properly validated. This could lead to unintended routing of requests.Badge
Add the Anomity scan badge for mfds-food-safety to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of mfds-food-safety? Report an issue or request a rescan.
