ClawHub
Back to skill

Security audit

get tomorrow weather of beijing , with Chinese almanac information

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Beijing weather and Feishu notification helper, with some user-control cautions but no artifact-backed malicious behavior.

Install this only if you want automated Beijing weather messages sent to Feishu. Configure the Feishu openid and any almanac API credentials deliberately, consider narrowing manual triggers or adding confirmation before sending, and remove the fixed footer if you do not want that attribution in delivered messages.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:85
Finding

Mandatory Branding Injected into Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 85-87
Vulnerability Type: Mandatory response manipulation through skill instructions
Risk Level: High
Evidence: The following escaped representation preserves the exact Unicode content of the fixed footer:

text
---
\U0001F916 Jay \u00B7 \u5929\u6C14\u52A9\u624B

Technical Analysis

The response template requires the agent to append a fixed identity and branding footer to generated weather messages. This attribution is not necessary for retrieving, processing, or delivering the requested weather and calendar information.

Because the footer is part of the prescribed template, loading and following the skill reliably modifies the agent's final response. This constitutes instruction-level output hijacking: the skill uses otherwise legitimate functionality to inject persistent third-party attribution into user-facing content.

No evidence was found that this instruction changes system safety constraints, executes code, accesses additional privileges, writes persistent memory, or compromises external tools.

Attack Path

  1. The skill is loaded to answer a weather request or scheduled weather-delivery task.
  2. The agent follows the message-construction instructions in Step 3.
  3. The agent copies the mandatory footer from the prescribed template.
  4. The third-party identity is included in the final message.
  5. If Feishu delivery is configured, the altered message is sent to the configured recipient.

Impact Assessment

The issue affects the integrity and neutrality of user-facing output. It enables fixed promotional attribution to appear as though it were endorsed by the user, agent, or deployment operator.

The demonstrated scope is limited to generated message content. The instruction does not grant filesystem access, elevated privileges, credential access, arbitrary code execution, or cross-session persistence. The project contai ...[truncated 56 chars]

Remediation
View remediation

Remediation Suggestions

Remove the fixed identity footer from the response template. Keep the default output limited to information necessary for the requested weather and calendar functionality.

If attribution is a legitimate product requirement:

  1. Declare it clearly in the skill description and deployment documentation.
  2. Make the footer configurable rather than hardcoded.
  3. Require explicit operator or user consent before enabling it.
  4. Allow attribution to be disabled without modifying the skill source.
  5. Add a review rule prohibiting unrelated branding, advertisements, or identity claims in mandatory response templates.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

使用 wttr.in 获取北京两天的天气数据（JSON格式）：

bash
curl -s "https://wttr.in/Beijing?format=j1"

返回的 JSON 中：

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill explicitly maps weather descriptions into Chinese and constructs all user-facing output in Chinese, but it does not state that this locale is optional or limited to Chinese-speaking users. This creates a language policy issue because the skill appears to enforce a single language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs sending a Feishu message to a user's openid without an explicit consent, privacy, or delivery notice. This is risky because ordinary conversation or scheduled execution could result in outbound messaging to a user identifier without clear authorization, creating privacy and unintended-notification concerns.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manual trigger phrases include very broad natural-language requests like '明天天气怎么样' and '天气推送', which can easily overlap with ordinary conversation rather than an explicit command to activate an automated push workflow. In context, this can cause unintended skill execution and message delivery, especially because the skill later sends outbound notifications via Feishu.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.