ClawHub
Back to skill

Security audit

中国城市天气Weather In China

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward China weather lookup tool with disclosed network use and no evidence of hidden data theft, persistence, or destructive behavior.

Install this if you want a Chinese-language China weather lookup and are comfortable with it installing the Python requests package and contacting weather.com.cn. For stronger supply-chain control, pin requests to a reviewed version and keep invocations limited to explicit weather queries.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:6
Finding

Unpinned Third-Party Python Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:6
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

yaml
metadata: { "openclaw": { "emoji": "🌤️", "requires": { "bins": ["python"], "pip": ["requests"] } } }

Technical Analysis

The Skill declares requests as an automatically installed dependency without specifying an audited version or package hash. Consequently, dependency resolution can select a different package release whenever the Skill is installed. This makes installation non-reproducible and exposes it to upstream package compromise, package-index compromise, or an unexpectedly incompatible future release.

No evidence indicates that the current requests package is malicious. The risk arises because the Skill does not constrain or verify the code retrieved from the package source.

The runtime network request in weather-cn.py:47-59 is not sensitive-data exfiltration. It sends a public city code over HTTPS to the declared weather provider, www.weather.com.cn, and is necessary for the advertised weather-query functionality.

Attack Path

  1. An attacker compromises the configured Python package index, the upstream dependency release process, or an unconstrained transitive dependency.
  2. The Agent installs the Skill in a new environment.
  3. The package resolver retrieves the attacker-controlled or compromised dependency because no version or integrity hash is enforced.
  4. Malicious installation or imported runtime code executes under the privileges of the user or Agent performing the installation.
  5. That code may access data and resources available to the installation environment.

Impact Assessment

Successful exploitation could execute arbitrary Python code with the privileges of the installing or invoking Agent. The accessible scope could include the Agent workspace, environment variables, user-readable files, and network access. This declaration does not itself grant ad ...[truncated 106 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin requests to a reviewed version rather than allowing unrestricted resolution, for example:
yaml
metadata: { "openclaw": { "emoji": "🌤️", "requires": { "bins": ["python"], "pip": ["requests==2.32.5"] } } }
  1. Use a lock file or hash-verified requirements file, such as:
text
requests==2.32.5 --hash=sha256:<verified-package-hash>
  1. Pin and verify transitive dependencies where the installation system supports it.
  2. Configure installation to use a trusted package index over HTTPS and disable untrusted supplemental indexes.
  3. Periodically review and deliberately update pinned versions after checking security advisories and package integrity.
  4. Install dependencies in an isolated virtual environment with only the filesystem and network permissions required for weather retrieval.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation is entirely written in Chinese and presents the skill as a general usage guide without stating that it is intentionally limited to Chinese-speaking users or a China-specific audience. Under the policy criteria, forcing a specific language without user opt-in or a clearly documented justification is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises executable behavior that reads local files and performs network access, but it does not declare any explicit tool scope or permissions. In an agent environment, this weakens least-privilege controls and can cause the skill to be invoked with broader capabilities than reviewers or users expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The description labels the tool as a Chinese weather query tool, and the document consistently frames usage and output as Chinese-only, including "原生中文" and "中文天气查询". There is no indication that users may choose another language or that the locale restriction is optional, which can violate language/locale choice policy.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

方案2：Open-Meteo API

bash
curl -s "https://api.open-meteo.com/v1/forecast?latitude=39.9042&longitude=116.4074&current_weather=true&daily=temperature_2m_max,temperature_2m_min,weathercode&timezone=Asia%2FShanghai"

方案3：wttr.in

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to match ordinary weather-related conversation, which can cause the skill to auto-activate in contexts where the user did not explicitly request this specific integration. Because the skill performs network access and may execute local scripts, overbroad triggering increases the chance of unintended external requests and tool use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring presents the skill name and usage entirely in Chinese, and the runtime messages throughout the script also assume Chinese-language interaction. For a general-purpose script, this effectively forces a specific language without user opt-in, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This plain-text file uses Chinese headers and city names throughout, which imposes a specific language/locale without any visible opt-in or explanation. Under the policy rule, forcing a language can be a natural-language policy concern when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.