ClawHub
Back to skill

Security audit

Weather

Security checks across malware telemetry and agentic risk

Overview

This instruction-only weather skill uses curl to query public weather services and does not show hidden, persistent, or credential-seeking behavior.

Safe to install for normal weather lookups. Be aware that queried cities, coordinates, and your network IP may be visible to wttr.in or Open-Meteo, so avoid using precise private locations if that matters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
Free, no key, good for programmatic use:
```bash
curl -s "https://api.open-meteo.com/v1/forecast?latitude=51.5&longitude=-0.12&current_weather=true"
```

Find coordinates for a city, then query. Returns JSON with temp, windspeed, weathercode.
Confidence
50% confidence
Finding
https://api.open-meteo.com/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal