Security audit

Qweather

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent QWeather weather helper, but it publishes a real-looking API key in both documentation and source code, so it needs review before use.

Review before installing. The weather functionality is narrow and does not touch local files, but the embedded API key should be treated as exposed and rotated or replaced with a user-provided secret such as an environment variable. Also expect Chinese-only output, missing air-quality support, and limited location handling.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/qweather.py:17
Finding: Hardcoded API Key Exposed in Documentation and URL Query String
Content: View full analysis
``` Although HTTPS encrypts the request while it is in transit, URL query parameters may be retained by application servers, reverse proxies, monitoring platforms, request logs, exception reports, or debugging systems. Consequently, HTTPS does not fully protect a secret placed in a URL. The request is sent only to the declared QWeather host, and no evidence of transmission to unrelated destinations was found. Sending a location identifier to the weather provider is necessary for the declared weather-lookup function. Th ...[truncated 2010 chars]
Remediation: View remediation
`. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior does not match the detected implementation: some advertised features are missing, formatting is inconsistent, and undisclosed capability such as disaster alert handling appears present. In agent systems, behavior mismatches are security-relevant because reviewers and orchestrators may permit a skill based on its stated purpose while the actual code performs additional or different actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A concrete QWeather API key is embedded directly in the skill documentation, exposing a credential to anyone who can read the file. Even if the key has IP or domain restrictions, disclosure enables unauthorized reuse attempts, quota exhaustion, operational disruption, and leakage of account-associated metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation not only contains a live-looking API key but presents it without any warning or secure-handling guidance, normalizing unsafe credential practices. This increases the chance that the secret will be copied into logs, derivative skills, or public repositories, amplifying the exposure risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest explicitly says the skill should be used for air-quality requests, but the ENDPOINTS mapping only includes now, 7d, 24h, indices, and warning. There is no air-quality API path, parsing logic, or output formatting, so an advertised core capability is missing from the implementation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill invokes a networked weather API but does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations weaken least-privilege controls and make it harder for the platform or reviewer to understand and constrain external connectivity.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: All user-facing documentation and invocation guidance in this file are written only in Chinese, and the skill does not indicate that language choice is optional or that the tool is intentionally restricted to a Chinese-speaking context. The policy requires flagging locale or language constraints when they are imposed without user opt-in or clear justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language usage and output strings are entirely in Chinese, and the script does not offer any language or locale selection. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script embeds a live API key directly in source and sends it on every request as a query parameter. Hardcoded secrets are easily exfiltrated from the repository or logs, and query-string credentials may be exposed through intermediaries, debugging output, or request logging, enabling unauthorized use of the API account.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest says the skill supports queries by city code, city name, and latitude/longitude. In code, main() simply takes argv[2] as a location string and appends it directly to the API request; there is no geocoding, validation, or transformation logic for city names or coordinates, so the advertised support is not actually implemented here.
Content: No source excerpt is available for this finding.