Shuzhi Weather

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:57 AM UTC
• Version: 1.0.0

Overview

The weather skill mostly matches its stated purpose, but it stores API credentials in a local file and can print sensitive config contents when the file is malformed.

Review this before installing or use only after the credential handling is fixed. Use a dedicated low-privilege Shuzhi API key, keep the config file private with restrictive permissions, do not store unrelated secrets in it, and avoid running the script where stderr is captured until config values are redacted from errors.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_weather.py:62

Finding

API Credential Disclosure Through Configuration Error Logging

Content

View full analysis

Vulnerability Details

File Location: scripts/get_weather.py, lines 62–66 and 109–112
Vulnerability Type: Sensitive information exposure through error messages
Risk Level: Medium

Vulnerable Code

python

if 'app_key' not in config or 'app_secret' not in config:
    raise ValueError(
        f"Config file is missing required fields: 'app_key' and 'app_secret'\n"
        f"Current config: {config}"
    )

The resulting exception is subsequently written to standard error:

python

try:
    credentials = load_config()
except (FileNotFoundError, ValueError) as e:
    print(f"Configuration error: {e}", file=sys.stderr)
    return None

Technical Analysis

When either app_key or app_secret is absent, the validation error embeds the entire parsed configuration dictionary in its message. The caller then prints that exception to standard error.

Consequently, a partially configured file containing an app_secret but no app_key exposes the secret. Any unrelated tokens, credentials, or private values stored in the same JSON object are also disclosed.

Standard error may be retained by terminal capture, CI/CD logs, agent transcripts, process supervisors, centralized logging systems, or monitoring platforms. The disclosure does not require cryptographic compromise because the raw configuration values are directly serialized.

The Base64 operations elsewhere in the script are not evidence of covert exfiltration: they encode HMAC-SHA256 digests required by the documented authentication protocol. The raw app_secret is not transmitted to the API. Reading the designated credential file and sending the app key, signatures, and requested coordinates to the hardcoded HTTPS weather endpoint are consistent with the Skill's declared functionality and do not exceed its necessary privilege scope.

Attack Path

1. An attacker with configuration-write access, or an accidental configuration mistake, creates a JSON configuration containing ...[truncated 1381 chars]

Remediation

View remediation

Remediation Suggestions

Do not include configuration contents or credential values in exception messages. Report only the names of missing fields:

python

required_fields = ("app_key", "app_secret")
missing_fields = [
    field for field in required_fields
    if not isinstance(config.get(field), str) or not config[field].strip()
]

if missing_fields:
    raise ValueError(
        f"Config file is missing or has invalid required fields: "
        f"{', '.join(missing_fields)}"
    )

Apply the following additional hardening measures:

1. Validate that the parsed JSON root is an object before accessing its fields.
2. Require both credentials to be non-empty strings.
3. Redact secrets from every diagnostic and exception path.
4. Log only minimal operational context, such as the configuration path and missing field names.
5. Recommend and, where practical, verify restrictive file permissions such as 0600.
6. Add automated tests confirming that malformed configurations never place credential values in stdout, stderr, exceptions, or logs.
7. Avoid broad exception reporting where future exception messages could contain request headers or other sensitive context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill describes capabilities that require reading a user-local config file and making outbound network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where the runtime or reviewer may not clearly constrain what the skill is permitted to access, increasing the risk of unintended file access or network use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The skill instructs users to store long-lived API credentials in a predictable file under the home directory, creating session persistence of sensitive secrets. If the local environment, other skills, or logs are compromised, these credentials may be exposed and reused beyond the immediate task.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

IMPORTANT: Before using this skill, you must configure your API credentials:

Create the configuration file at ~/.openclaw/skills/shuzhi-weather/config.json with the following content:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The activation rules are broad enough to trigger on general weather conversation, not just clear requests to call the external API. Over-broad invocation can cause unnecessary network calls, unexpected credential use, or the skill taking over interactions that could have been handled without tools.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_response_format.md (reported line 84)May include surrounding context.

Example Request

bash

curl -X POST "https://test-apisix-gateway.shuzhi.shuqinkeji.cn/2033738771717074945" \
  -H "X-HMAC-ACCESS-KEY: your_app_key" \
  -H "X-APP-PRODUCT-ID: 2033747427070226434" \
  -H "X-HMAC-ALGORITHM: hmac-sha256" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file instructs users to store app_key and app_secret in a local config file, but it does not warn that these are sensitive credentials or advise protecting the file from disclosure. For markdown files, omitting warnings about behaviors that could affect privacy or system integrity qualifies as a missing user warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.