Security audit

QWeather

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent QWeather helper, but it needs review because it handles API credentials and can send or cache bearer tokens without enough safeguards.

Review before installing. Use only a QWeather API host copied from the official console, keep the private key and local/ directory owner-readable only, do not commit local files, and be aware that setup and tests make network requests and create local state.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/qweather.sh:36
Finding: Unvalidated API Host Can Receive QWeather Authentication Tokens
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/gen-jwt.mjs:49
Finding: JWT Cache File Is Written Without Explicit Restrictive Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
- JWT（Ed25519），通过 `scripts/gen-jwt.mjs` 生成，支持 token 缓存（`local/jwt-cache.json`）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
- JWT（Ed25519），通过 `scripts/gen-jwt.mjs` 生成，支持 token 缓存（`local/jwt-cache.json`）

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises and instructs use of shell, network, and environment-backed capabilities, but it does not declare any explicit tool scope or permission boundaries. This makes the operational trust boundary unclear and can allow an agent runtime to invoke powerful capabilities more broadly than a user would reasonably expect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The operational instructions for the skill are presented in Chinese and direct the agent behavior in that language, but there is no indication that the user can choose another language or that the locale restriction is intentional for a region-specific compliance reason. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The first-run flow tells the agent to automatically create files, generate keys, and execute shell scripts, but it does not require a clear consent checkpoint for filesystem writes and command execution. In practice, this can lead to surprising local changes, script execution, or persistence actions before the user fully understands the side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script caches a live JWT bearer token in a predictable local file under ../local/jwt-cache.json without any access-control hardening, encryption, or warning to the operator. If that directory is readable by other local users, accidentally committed, included in logs/backups, or exposed by tooling, the token can be reused until expiry to access the QWeather API as the project.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script's prompts are entirely in Chinese and the API connectivity test explicitly sets lang=zh, which forces a specific language/locale. This is a natural-language policy issue because no user opt-in or configurable language choice is provided in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script defaults to a Chinese city name and later forces lang=zh in API requests while all user-facing help and output strings are in Chinese. This is a natural-language locale constraint with no user opt-in or language selection mechanism, which fits the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The inline comment is written in Chinese (还剩 60 秒以上才复用) while the rest of the script and user-facing messages are in English. This imposes a locale choice in natural-language content without offering user choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The inline comment is written in Chinese (1 小时有效期) while the surrounding code and messages are in English. This creates a natural-language locale inconsistency that effectively forces one language without opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code performs outbound HTTP requests with a bearer token and user-supplied city/location data via curl, but the script provides no visible notice, prompt, or comment warning users that their query will be sent to a remote weather service. For code files, network calls that transmit user or system data should have some form of disclosure unless clearly covered elsewhere, and no such warning is present in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This shell script emits user-facing status messages and test descriptions entirely in Chinese, which imposes a specific language on users without any opt-in or stated regional justification. The policy explicitly calls for flagging language or locale constraints when they are forced rather than optional or documented as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.