China Weather Query

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:40 PM UTC
• Version:
  1.1.0

Overview

This is a straightforward China weather lookup skill that reads a bundled city list and contacts the disclosed weather service, with no evidence of credential access, persistence, or destructive behavior.

Install only if you are comfortable with the skill making weather queries to weather.com.cn. For tighter containment, run it with file access limited to its bundled references/cities.json and avoid relying on the extra OpenClaw workspace fallback paths unless needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes code that performs network access and reads local files (for example, the city code table) but does not declare corresponding permissions. This creates a trust and review gap: the runtime capabilities of the skill exceed what a user or platform reviewer can infer from metadata, increasing the chance of unintended data access or undisclosed external communication.

VirusTotal

43/43 vendors flagged this skill as clean.