T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:19- Finding
Command Injection Through Editable Weather Query Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Weather Assistant
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent weather-and-WeChat-push assistant, but it asks the agent to run shell commands with user-editable city query values, which creates a real command-injection risk.
Review before installing. Only use trusted city query values, avoid special shell characters in `query`, and prefer a version that validates or URL-encodes city names and invokes HTTP requests without shell interpolation. Confirm that the daily WeChat cron job, recipient, and quote-file access match what you want.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README describes automatic WeChat delivery of weather reports but does not clearly warn users that content will be transmitted to an external messaging channel on a schedule. Even if the payload is low sensitivity by design, city preferences, aliases, and timing metadata can still reveal personal patterns, and silent scheduled delivery increases privacy risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The cron payload instructs the agent to produce a Chinese weather broadcast with fixed Chinese phrasing such as "早安" and other Chinese output conventions, and the README does not offer opt-in or alternative locale behavior. This is a natural-language locale constraint that can violate policy when imposed without user choice or explicit justification.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The README includes an example for sending messages through a local Gateway API to a WeChat channel, which is an external transmission path. In context, this is the intended feature rather than covert exfiltration, but it still creates a real outbound data flow that can leak message content or recipient metadata if misconfigured or used without informed consent.
- Content
手动推送示例：
bash TOKEN=$(bash ~/.qclaw/scripts/get-token.sh) curl -X POST "http://localhost:{GATEWAY_PORT}/api/v1/messages/send" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README lists generic trigger phrases such as "天气", "查天气", "今天天气", and especially "weather" without narrowing context, exclusions, or negative examples. These phrases are common in ordinary user conversation and could cause unintended skill activation when the user is merely discussing weather rather than invoking the skill.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 1. 创建目录和配置文件 mkdir -p ~/.qclaw/skills/weather-assistant cat > ~/.qclaw/skills/weather-assistant/config.json << 'EOF' { "cities": [
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger description is broad enough to activate on ordinary weather-related conversation, which can cause the skill to run in contexts the user did not clearly intend. Because this skill performs external network requests and supports push-delivery behavior, over-triggering increases the chance of unintended data access, configuration edits, or surprise execution of side-effecting actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description does not clearly warn users that it will make external requests to wttr.in and may automatically deliver content to WeChat on a schedule. Missing disclosure weakens informed consent and can surprise users with outbound data flows or automated messaging, especially when combined with broad triggering and configuration features.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill relies on requests to wttr.in but does not clearly disclose that city query data is sent to a third-party service. While the transmitted data is limited, external lookups can still reveal user interests, approximate location preferences, or schedule-linked behavior to an outside provider.
- Content