ClawHub
Back to skill

Security audit

Weather Skill

Security checks across malware telemetry and agentic risk

Overview

This paid weather skill mostly does what it says, but it publishes and uses a billing API key in the skill files.

Review carefully before installing. Only use this skill if you accept paid per-call execution, and the publisher should remove and rotate the exposed SkillPay API key before broader use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'payload' from os.environ.get (line 27, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"Content-Type": "application/json",
            "X-API-Key": SKILLPAY_API_KEY
        }
        response = requests.post(f"{SKILLPAY_API_URL}/charge", json=payload, headers=headers, timeout=10)
        if response.status_code == 200:
            data = response.json()
            if data.get("success"):
Confidence
98% confidence
Finding
The billing request sends a user identifier and uses a secret API key to an externally configurable endpoint derived from environment variables. Because the destination URL can be overridden and the code also ships with a live-looking default secret, this creates a strong exfiltration risk: credentials and user data may be transmitted to an attacker-controlled service if the environment is tampered with or the default endpoint is untrusted.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The skill documentation exposes a live-looking SkillPay API key directly in SKILL.md, which is unrelated to a simple weather-query description and could allow unauthorized payment API access or abuse. Publishing secrets in a distributable skill file materially increases the chance of credential theft, fraudulent charges, account takeover, or misuse of the payment integration.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The skill advertises itself as a simple weather lookup, but it also performs a billing workflow before serving results. This mismatch is security-relevant because hidden side effects reduce informed consent and make it easier to trick users or platforms into invoking paid or data-sharing behavior they did not expect.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill states it uses wttr.in but does not warn users that their location queries will be sent to an external third-party service. Even if city names seem low sensitivity, location requests can reveal travel plans, home/work areas, or other personal context, so omission of this disclosure undermines informed consent and privacy expectations.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code transmits user_id to an external billing service without visible notice, consent, or minimization. Even if billing is legitimate, undisclosed sharing of user identifiers creates privacy and compliance risk and can expose users to tracking across services.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:26