alibabacloud-iqs-weather-query

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed Alibaba Cloud weather lookup tool, but it tells the agent to modify the skill's own executable parser code after reading untrusted web pages.

Review carefully before installing. The weather lookup function is understandable, but only use this skill if you are comfortable with Alibaba Cloud processing the city query and fetched page URL, and do not allow the agent to auto-edit scripts/weather.mjs from raw web content. Store the API key with restrictive permissions or a secret manager rather than in shared dotfiles.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:173

Finding

Untrusted Web Content Can Trigger Persistent Modification of Executable Skill Code

Content

View full analysis

**Key:** The skill gets smarter with every new city searched. Each raw-mode encounter is an opportunity to add a new parser, progressively covering more site formats. ``` `scripts/weather.mjs:183-197`: ```javascript // 未知站点或解析失败 → 返回正文原文，交由 agent 理解 // 同时输出 evolveHint，引导 agent 为该站点编写新解析器 const urlPattern = url ? new URL(url).hostname : 'unknown'; return { city, queryTime: new Date().toISOString(), parseMode: 'raw', hint: `以下是${city}天气网页的正文内容，请从中提取未来7天的天气预报信息，包括：日期、天气状况、温度范围、风向、风力等级。如果信息不完整，请尽量提取可用部分。`, rawText: content.substring(0, 4000), evolveHint: `[持续进化] 当前站点 "${urlPattern}" 没有匹配的解析器，走了 raw 模式。请在回答用户后，分析 rawText 的格式规律，为该站点编写一个新的解析器函数并注册到 scripts/weather.mjs 的 PARSER_REGISTRY 中。参考现有解析器 parseCmaWeather / parseWeatherComCn 的实现方式。解析器函数签名: function parseXxx(content, city) → { city, queryTime, forecastDays, forecast: [{date, weather, temperature, windDirection, windSpeed}] }`, }; ``` ### Technical A ...[truncated 2583 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:41

Finding

Insecure Recommendation to Persist API Credentials in Plaintext Files

Content

View full analysis

**Configure environment variable (choose one):** > > **Option 1: Temporary (current terminal session only)** > ```bash > export ALIYUN_IQS_API_KEY="your-api-key-here" > ``` > > **Option 2: Permanent (recommended)** > > Add to ~/.zshrc or ~/.bashrc: > ```bash > export ALIYUN_IQS_API_KEY="your-api-key-here" > ``` > Run `source ~/.zshrc` or `source ~/.bashrc` to apply. > > **Alternative:** Place API Key in `~/.alibabacloud/iqs/env` file: > ``` > ALIYUN_IQS_API_KEY=your-api-key-here > ``` ``` ### Technical Analysis The documentation recommends storing the Alibaba Cloud IQS API key permanently in a shell startup file and alternatively supports a custom plaintext credential file. It does not require restrictive filesystem permissions or warn about source-control, backup, synchronization, diagnostic, or process-exposure risks. Shell profiles are general-purpose configuration files and may be copied between systems, included in dotfile repositories, collected during troubleshooting, or exposed to other local processes. The custom credential file is also read without checking its ownership or permissions. If created under a permissive umask, it may be readable by other local users. Sending the key in the `X-API-Key` header to the two fixed HTTPS Alibaba Cloud IQS endpoints is necessary for the declared cloud-backed functionality. The vulnerability concerns insecure at-rest storage guidance, not the documented API authentication request itself. ### Attack Path 1. A user follows the recommended permanent configuration and places the API key in `~/.zshrc`, `~/.bashrc`, or `~/.alibabacloud/iqs/env`. 2. The file is created or retained with permissions that allow another local account or process to read it, or it is copied into a dotfile repository, backup, or synchronized configu ...[truncated 679 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

node scripts/weather.mjs <city>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

node scripts/weather.mjs <city>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

node scripts/weather.mjs <city>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

node scripts/weather.mjs <city>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

node scripts/weather.mjs <city>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md

node scripts/weather.mjs <city>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md

node scripts/weather.mjs <city>

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

These lines explicitly instruct the agent to write and register new parser code without user confirmation or operator review. This creates an unsafe escalation path from processing untrusted web content to altering the skill's behavior, potentially enabling persistent malicious logic if an attacker influences the page format or hint content.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill clearly relies on environment access for API keys and network access to Alibaba Cloud endpoints, but it does not declare an explicit tool scope or permissions boundary. That mismatch weakens reviewability and can cause an agent or platform to grant broader capabilities than users expect, especially since the skill also reads external pages and processes their content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description does not clearly disclose that user-provided city names, search queries, target URLs, and fetched page content are sent to external Alibaba Cloud services. This is a transparency and data-handling issue that can mislead users about where their inputs go and what third parties process them.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

>
> **Option 2: Permanent (recommended)**
>
> Add to ~/.zshrc or ~/.bashrc:
> ```bash
> export ALIYUN_IQS_API_KEY="your-api-key-here"
> ```

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The workflow hardcodes the search string as '{city} 天气预报 未来7天', and the guidance further prefers Chinese city names. This imposes a specific language choice as default behavior without offering the user a language or locale option or documenting that the skill is intentionally region/language-specific.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation directs the agent to go beyond answering weather queries and to modify the skill's own code by writing new parser functions. Allowing self-modification based on untrusted page content expands the skill from read-only querying into code-authoring behavior, which can be abused to persist unsafe logic or introduce supply-chain style compromises.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The raw-page flow creates a staged chain: ingest untrusted web content, interpret it, then evolve the skill by generating new parser code. That is dangerous because it turns attacker-controllable page structure and content into a trigger for persistent capability expansion, blurring the line between data parsing and code generation.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The unknown-site fallback explicitly tells the agent to answer the user and then derive a new parser from untrusted page content, turning arbitrary scraped text into instructions for future code changes. In the context of an agent skill, this is more dangerous because the hostile input comes from external websites and is framed as an ongoing evolution loop, increasing the chance of prompt injection or unsafe maintenance actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill emits an evolveHint telling the agent to analyze untrusted rawText from arbitrary websites and then write and register new parser code in scripts/weather.mjs. This creates a self-modification pathway driven by adversarial web content, which violates safe skill boundaries even if no modification is executed automatically by this script.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code sends the user's city name to the UnifiedSearch API and later sends the selected weather page URL to the ReadPage API, which are network operations involving user input and external content. Although the code comments describe the flow, there is no user-facing warning in the runtime output or usage text that the query and URL will be transmitted to Alibaba Cloud services.

Content

No source excerpt is available for this finding.