ClawHub

Yr Weather

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward weather skill that sends user-provided coordinates to MET Norway for forecasts, with no evidence of hidden persistence, credential access, or destructive behavior.

Reasonable to install for weather lookups. Be aware that each query sends the coordinates you provide, and optional altitude, to MET Norway; use approximate coordinates if location privacy matters. If installing from the GitHub pip command rather than the ClawHub artifact, pin a reviewed release or commit.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill explicitly invokes Python scripts that call the external yr.no/MET API, so it does have network capabilities despite no declared permissions. This is not inherently malicious in a weather skill, but the missing permission declaration reduces transparency and weakens policy enforcement, making it easier for users or platforms to underestimate outbound data flow.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal