ClawHub
Back to skill

Security audit

Weather

Security checks across malware telemetry and agentic risk

Overview

This is a simple weather helper whose network use matches its purpose, with a minor privacy consideration for location lookups.

Before installing, understand that weather queries you run with this skill will contact public weather services and may disclose the city, airport code, or coordinates you enter. Avoid using precise home addresses or sensitive operational locations if that matters to you.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
89% confidence
Finding
The skill includes examples that send user-provided locations or coordinates to third-party weather services over the network without explicitly warning about that data disclosure. While the transmitted data is typically low sensitivity, locations can reveal personal or operational information, so the omission is a real privacy/security concern rather than a false positive.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.