Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add isnow890/naver-search-mcp --skill naver-search-mcpgit clone --depth 1 https://github.com/isnow890/naver-search-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/isnow890/naver-search-mcp/naver-search-mcp)<a href="https://agentmods.dev/skills/isnow890/naver-search-mcp/naver-search-mcp"><img src="https://agentmods.dev/badge/skills/isnow890/naver-search-mcp/naver-search-mcp/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/isnow890/naver-search-mcp/naver-search-mcp"><img src="https://agentmods.dev/badge/skills/isnow890/naver-search-mcp/naver-search-mcp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 15 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 49 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Excessive Agency · line 61 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.01082 |
| Opus 5.5 | $0.00020 | $0.00433 |
| Sonnet 5.5 | $0.00010 | $0.00216 |
| Haiku 4.5 | $0.00005 | $0.00108 |
Grade A, and why
naver-search-mcp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Naver Search MCP
Use this skill for Korean search tasks that are better served by Naver than general web search: news, blogs, cafe posts, images, Knowledge iN, encyclopedia, local places, and DataLab trend analysis (search trends and shopping insight).
한국 웹 검색, 네이버 뉴스/블로그/카페/이미지/지식iN/백과사전/지역 검색, 네이버 DataLab 검색어 트렌드와 쇼핑인사이트 분석에 사용합니다.
github: https://github.com/isnow890/naver-search-mcp
This skill wraps the published MCP server:
npx -y @isnow890/naver-search-mcp
Setup
- Install from ClawHub with
openclaw skills install naver-search-mcp. - Supply one credential pair — never a partial mix of the two:
- NAVER API HUB (Recommended / New setups):
NCP_APIGW_API_KEY_IDandNCP_APIGW_API_KEYfrom NAVER Cloud Platform console. - Naver Developers (Legacy / Existing keys only):
NAVER_CLIENT_IDandNAVER_CLIENT_SECRET(Supported until 2027-06-30).
- NAVER API HUB (Recommended / New setups):
- In OpenClaw,
apiKeymaps toNCP_APIGW_API_KEY. SetNCP_APIGW_API_KEY_IDin the skillenvconfiguration. - Restart OpenClaw or the Gateway after changing credentials.
Example OpenClaw Config (NAVER API HUB - Recommended)
{
"skills": {
"entries": {
"naver-search-mcp": {
"enabled": true,
"apiKey": "your_ncp_apigw_api_key",
"env": {
"NCP_APIGW_API_KEY_ID": "your_ncp_apigw_api_key_id"
}
}
}
}
}
Example OpenClaw Config (Naver Developers - Legacy)
For users with existing Naver Developers keys, specify both variables explicitly in env:
{
"skills": {
"entries": {
"naver-search-mcp": {
"enabled": true,
"env": {
"NAVER_CLIENT_ID": "your_naver_client_id",
"NAVER_CLIENT_SECRET": "your_naver_client_secret"
}
}
}
}
}
Search Guidance
- Prefer this skill when the user wants Korean-source results, Naver-specific results, Korean shopping insight data, or Korean local data.
- Choose the tool that matches intent: news, blog reviews, cafe discussions, images, local places, encyclopedia lookup, or general Korean web search.
- For shopping data, use DataLab Shopping Insight (
datalab_shopping_*plusfind_category). - Summarize results instead of dumping raw API output. Include source, date, link, price, location, or category details when useful.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 20d ago Changed · -2 lines ccf20eaff2ff
- 1mo ago First seen · 114 lines · 51 tokens per session scan A 16561dd7760e
naver-search-mcp is a skill published in the GitHub repository isnow890/naver-search-mcp (87 stars, last pushed 20d ago), licensed MIT. It adds 51 tokens to every session and 1,082 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
api-simulation
Runs your code for real against stand-ins for the HTTP services it calls, served together as one environment on one local port or one deployed URL, whether that code is a service you're changing, a frontend, a test suite or a demo. Use when you add or change code that calls other services and need to run it, test it…
application-testing
Sets up, runs, debugs, and interprets results from postman application test — the Postman layer that runs your Playwright tests, captures their network traffic, matches it against a collection contract, runs pm.test assertions, and publishes results to Application Inventory. Covers the Postman side of the integration…
variables
Use when parameterizing requests across environments, choosing variable scopes, chaining values in scripts, or referencing credentials without committing or exposing them. Keeps one reusable collection while separating target configuration from secret values. Use for requests such as "where should I put this API key".
bootstrap
Use when resolving Postman CLI setup, authentication, or a repository workspace binding; initializing local API files; handling a CLI error that says an operation isn't allowed because of insufficient entitlements; or importing, pulling, pushing, syncing, or sharing workspace resources. Reuses existing context and…
api-mocking
Finds, builds, runs and publishes a stand-in for one API — the owning team's published mock when there is one, otherwise one built from its spec or collection that behaves like the real API, stateful when callers write then read. Use when something needs an API that isn't built or reachable yet (a frontend, client or…
webhook-testing
Capture, forward to localhost, replay, and validate webhook deliveries using a reusable public URL. Keep sender configuration across debugging sessions and record arrivals even while local forwarding is stopped, helping distinguish delivery failures from local connectivity issues. Use for implementing or debugging…