ClawHub

Weather Intelligence Digest Fresh

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it fetches NOAA/NWS weather data for user-configured locations and writes local digest files.

Install in a virtual environment, review the requests version if reproducibility matters, only include locations you are comfortable sending to NOAA/NWS, and avoid opening or publishing generated HTML from untrusted config/API content without escaping or reviewing it first.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tainted flow: 'html' from pathlib.Path.read_text (line 306, file read) → pathlib.Path.write_text (file write)

Medium
Category
Data Flow
Content
if args.html_path:
        html = build_html(reports, theme=args.theme)
        html_path = Path(args.html_path)
        html_path.write_text(html)
        print(f"HTML digest written to {html_path} (theme: {args.theme})")
    if args.json_path:
        json_payload = build_json_document(reports)
Confidence
93% confidence
Finding
html_path.write_text(html)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation advertises and instructs use of capabilities that imply local file read/write and outbound network access, but it does not declare any permissions. This creates a transparency and sandboxing gap: users or orchestration systems may approve or run the skill without realizing it can read configuration files, write output files, and contact external services.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal