ClawHub
Back to skill

Security audit

HKO Weather

Security checks for vulnerabilities and agentic risk

Overview

This is a Hong Kong weather skill that fetches public HKO data and formats it, with optional Discord-related documentation but no hidden credential use or automatic posting code in the artifacts.

Before installing, verify the install path and only enable Discord or scheduled posting if you are comfortable sending weather-update content to that channel. No API keys are required for HKO data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The README documents automatic posting of weather updates to Discord but does not clearly warn that enabling this feature sends skill-generated content to a third-party external service. Even if the posted content is only weather data, channel identifiers, usage patterns, timestamps, and future configuration expansion can create unintended data disclosure or compliance issues, especially in enterprise or privacy-sensitive environments.

Static analysis

No suspicious patterns detected.