ClawHub
Back to skill

Security audit

天气预报查询

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Chinese weather skill that calls wttr.in for forecasts, with privacy and transport-security caveats but no evidence of deception, persistence, credential access, or destructive behavior.

Install only if you are comfortable with weather queries being sent to wttr.in and, when no city is supplied, wttr.in inferring location from the request IP. Prefer giving an explicit city, and consider updating the script to use an explicit https://wttr.in URL with URL-encoded city names.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/weather.py:49
Finding

Unencrypted Weather API Communication

Content
View full analysis

Vulnerability Details

File Location: scripts/weather.py, lines 49–52
Vulnerability Type: Plaintext HTTP communication
Risk Level: Medium

python
def get_weather(city: str) -> dict:
    """调用 wttr.in 获取天气数据"""
    try:
        # 使用 format=j1 获取 JSON 格式数据
        cmd = ["curl", "-s", f"wttr.in/{city}?format=j1"]
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)

Technical Analysis

The request URL does not specify an HTTPS scheme. Curl consequently treats the destination as an HTTP URL, transmitting the city query and receiving weather data without transport encryption or server authentication.

This exposes the request to passive observation and active man-in-the-middle modification. The city value can reveal location-related information. When no city is supplied, the external service performs source-IP-based geolocation, which necessarily discloses the requester's public IP to that service.

Data returned by the service is parsed as JSON and several remote fields are inserted directly into terminal and Markdown output. A network attacker capable of modifying the plaintext response could therefore supply misleading weather information or inject terminal or Markdown control content. This does not directly provide local command execution because the response is never passed to a shell or code evaluator.

Attack Path

  1. A user invokes the Skill with a city name or uses its automatic IP-location mode.
  2. The script constructs wttr.in/{city}?format=j1 without an HTTPS scheme.
  3. Curl sends the request over plaintext HTTP.
  4. An attacker positioned on the network observes the requested location or intercepts the response.
  5. The attacker returns modified, structurally valid JSON containing attacker-controlled display values.
  6. The script parses those values and prints them in terminal and Markdown output.

Impact Assessment

An attacker with a suitabl ...[truncated 452 chars]

Remediation
View remediation

Remediation Suggestions

  • Use an explicit HTTPS endpoint, such as https://wttr.in/....
  • URL-encode the city as a path component using urllib.parse.quote(city, safe="").
  • If curl remains in use, enforce secure transport and HTTP error handling with options such as --proto =https, --tlsv1.2, --fail, and --show-error.
  • Prefer a Python HTTPS client to remove the subprocess dependency and simplify timeout, response-size, content-type, and status-code validation.
  • Reject unexpectedly large responses and verify that the response content type and JSON structure match expectations.
  • Sanitize externally supplied text before inserting it into terminal or Markdown output, including stripping terminal escape and control characters.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill invokes local shell-capable components (python3 and curl) but does not declare any explicit tool scope or permissions in its manifest. This weakens least-privilege enforcement and makes it harder for a host agent to constrain execution, increasing the chance of unintended command execution or capability exposure if the skill is invoked in a broader runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises IP-based automatic location but provides no privacy notice, consent flow, or explanation that user network-derived location may be sent to or inferred by an external weather service. This creates a real privacy risk because users may unknowingly expose approximate location data during what appears to be a simple weather query.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad everyday language like '查天气' and '今天天气怎么样', which can match normal conversation frequently and cause unintended invocation. In an agent setting, overbroad triggers can lead to surprise tool use, unnecessary network requests, and accidental disclosure of user context to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script sends the user-supplied city to wttr.in, and if no argument is provided it falls back to an empty path that causes IP-based geolocation lookup by the remote service. This can disclose location-related personal data to a third party without explicit user consent or clear notice, which is a privacy issue in a weather skill where users may not expect IP-based inference.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/weather.py (reported line 52)May include surrounding context.

python
try:
        # 使用 format=j1 获取 JSON 格式数据
        cmd = ["curl", "-s", f"wttr.in/{city}?format=j1"]
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        if result.returncode != 0:
            return {"error": "网络请求失败"}
        data = json.loads(result.stdout)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The docstring and all user-facing status/output strings are written in Chinese, with no option to select another language or locale. This is a natural-language policy concern because the skill imposes a specific language experience without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.