Security audit

1asd1

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to provide the advertised weather features, but its paid billing script can charge users and handle a billing API key with weak safeguards.

Review this before installing if you do not want an agent to initiate SkillPay charges automatically. Prefer using SKILLPAY_API_KEY from a protected environment or secret store, avoid passing --api-key on the command line, and confirm that you are comfortable with city names going to wttr.in and billing identifiers going to SkillPay.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/billing.py:48
Finding: SkillPay API Key Exposure Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims forecast and clothing recommendation features that are reportedly not implemented, creating a trust gap between the declared functionality and actual behavior. In the context of a paid skill, this is more dangerous because users may be charged for capabilities they never receive, and reviewers may miss the true operational behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims forecast and clothing recommendation features that are reportedly not implemented, creating a trust gap between the declared functionality and actual behavior. In the context of a paid skill, this is more dangerous because users may be charged for capabilities they never receive, and reviewers may miss the true operational behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims forecast and clothing recommendation features that are reportedly not implemented, creating a trust gap between the declared functionality and actual behavior. In the context of a paid skill, this is more dangerous because users may be charged for capabilities they never receive, and reviewers may miss the true operational behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises executable scripts and appears to require environment, network, and shell capabilities, but it does not declare any explicit tool scope or permissions. This weakens sandboxing and review controls, making it easier for the skill to access sensitive capabilities without transparent authorization and increasing the risk of unintended network calls, environment-variable access, or command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The charge function sends a user identifier, skill identifier, amount, and description to a remote billing API, which is a safety-relevant network action affecting user data and billing state. The file contains no confirmation prompt, user-facing log message, or explanatory comment/docstring warning that a charge request will be transmitted.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code hardcodes user-facing labels, clothing descriptions, tips, and formatted output entirely in Chinese across the recommendation data and display strings. The policy allows locale constraints only when documented and justified or when the user is offered a choice, neither of which is present in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The formatted output hard-codes Chinese text such as '天预报', '体感', and '湿度' for all users. This imposes a specific language without user opt-in or a documented locale constraint, which is a natural-language policy violation under the stated rules.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest advertises current weather, multi-day forecasts, clothing index, and dressing recommendations. In the implementation, get_weather reads only current_condition and nearest_area from wttr.in, and the output contains current conditions and a generic comfort assessment, with no forecast retrieval or clothing recommendation logic.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code returns comfort labels and formatted weather output using Chinese strings such as "舒适", "温度", and "湿度". Because the skill does not offer any locale or language opt-in, it enforces a specific language in user-facing content, which matches the policy-violation category for language/locale constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file contains user-facing natural-language guidance entirely in Chinese, but it does not indicate that the skill is Chinese-only or provide any user opt-in for the language. Under the policy, forcing a specific language without user choice can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The helper reads SKILLPAY_API_KEY from the environment, which is access to sensitive credentials. This file does not include any comment, docstring detail, or user-facing output explaining that the skill depends on and consumes a secret API key.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The balance function performs a network request containing the user_id to retrieve billing information from an external service. There is no user-facing warning, log statement, or explanatory comment indicating that user billing data is sent off-host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The payment_link function transmits user_id, skill_id, and amount to a remote API to generate a payment link, which is a user-impacting network action. The code provides no warning, confirmation, or explanatory comment to disclose this external transmission.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes a broader feature set including current weather and clothing/dressing recommendations. In this file, the code fetches forecast data from wttr.in, extracts per-day forecast fields, and formats forecast output, but there is no logic that computes or returns clothing advice, and no separate current-weather operation beyond using forecast/hourly data as a proxy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code constructs an external HTTP request to wttr.in using the user-supplied city value and transmits it over the network. There is no confirmation prompt, disclosure message, or explanatory comment warning that location-related input will be sent to a third-party service.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.