ClawHub
Back to skill

Security audit

Weather Query

Security checks for vulnerabilities and agentic risk

Overview

This China weather skill coherently uses two small local scripts to query an external weather API, with no evidence of hidden persistence, credential access, or destructive behavior.

Before installing, understand that city or district names you ask about will be sent to an external weather API. Avoid using unusually precise or sensitive location details if that matters to you. The skill appears narrow and purpose-aligned for China weather queries.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to execute local shell scripts (`./scripts/realtime.sh` and `./scripts/forecast.sh`) but does not declare any explicit tool scope or allowed-tools boundary. This creates a capability mismatch where shell execution may be invoked without clear least-privilege constraints, increasing the risk of unintended command execution or abuse if the surrounding agent framework permits broad shell access.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The instruction 'Always use Chinese characters for location names' imposes a language/locale requirement in natural language. The file does not provide user opt-in, alternatives, or an explicit policy justification for forcing Chinese input, so this matches the locale-policy violation criteria.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The error message states that the required query parameter "must be in Chinese," which imposes a language constraint in natural-language behavior. This is a locale/language policy issue because the script does not provide opt-in, alternatives, or any documented region-specific justification for the restriction.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The error message states that the query parameter 'must be in Chinese,' which imposes a language requirement. This is a natural-language policy concern because the script does not offer opt-in language selection or explain a justified region- or compliance-specific reason for restricting input to Chinese.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script sends the user-supplied weather query to a third-party service over the network without any explicit disclosure, consent prompt, or documentation in the script output. Even though the query is URL-encoded and there is no command-injection issue here, location queries can contain sensitive or identifying information, creating a privacy and data-handling risk.

Static analysis

No suspicious patterns detected.