ClawHub
Back to skill

Security audit

Go Stargazing

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a disclosed stargazing weather-planning tool, with ordinary privacy and dependency cautions but no evidence of malicious behavior.

Install only if you are comfortable sharing queried stargazing coordinates with Open-Meteo during real-weather lookups. For stricter environments, pin the Python dependencies before deployment and review any user-supplied polygon file paths, since the tool can read JSON boundary files when explicitly provided.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares no permissions while its own specification clearly indicates file reads from packaged data files and outbound network access to the Open-Meteo API. Hidden or undeclared capabilities weaken user and platform consent boundaries, making it harder to assess privacy, data exposure, and operational risk before execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The documented behavior understates the skill's effective capabilities by omitting external network access and ancillary lunar/calendar functionality. Description-behavior mismatches are dangerous because operators may approve or invoke the skill under incomplete assumptions, enabling unexpected data flows or actions outside the stated scope.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The code sends precise latitude, longitude, and timezone values to a third-party weather API. Even though this is functionally necessary for weather lookups, it is still an external disclosure of potentially sensitive location data, especially if points correspond to user-selected or personally meaningful places.

Unpinned Dependencies

Low
Category
Supply Chain
Content
lunarcalendar
shapely
Confidence
94% confidence
Finding
lunarcalendar

Unpinned Dependencies

Low
Category
Supply Chain
Content
lunarcalendar
shapely
Confidence
94% confidence
Finding
shapely

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.