Weather Checker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:58 PM UTC
• Version: 1.0.0

Overview

The weather tool itself is straightforward, but its install instructions download mutable remote code and optionally install it system-wide with sudo, so it needs review before installation.

Install only after replacing the remote curl step with the bundled reviewed script or a pinned, checksummed release. Prefer a virtual environment and a user-local command path over sudo, and understand that city searches and coordinates are sent to Open-Meteo APIs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:30
• Finding: Mutable Remote Executable Downloaded Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:30-36` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -O https://raw.githubusercontent.com/yourusername/weather-checker/main/weather_checker.py chmod +x weather_checker.py ``` ```bash sudo ln -sf $(pwd)/weather_checker.py /usr/local/bin/weather-checker ``` ### Technical Analysis The installation instructions download a Python executable from the mutable `main` branch of a placeholder or personal GitHub repository. The downloaded artifact is not pinned to an immutable commit and is not authenticated using a cryptographic checksum or signature. The project already contains an auditable local copy of `weather_checker.py`, so retrieving another copy from an external location is unnecessary for the declared weather-checking functionality. More importantly, the remotely retrieved file can differ from the bundled file reviewed during this audit. Marking the downloaded file executable and exposing it through a command allows subsequently modified remote content to execute on the user's system. Compromise of the referenced account, repository, branch, or delivery path could therefore alter the effective payload after the Skill has been approved. ### Attack Path 1. An attacker gains control of the referenced GitHub account or repository, or the placeholder URL is later registered and controlled by an untrusted party. 2. The attacker replaces `weather_checker.py` on the `main` branch with malicious Python code. 3. A user follows the documented installation procedure. 4. `curl` downloads the attacker-controlled script without integrity verification. 5. The user marks the downloaded payload executable. 6. The script is exposed as the `weather-checker` command. 7. When the user invokes that command, the malicious payload executes with the invoking user's privileges. ### Impact Assessment Successful exploitation permits arbitrary co ...[truncated 529 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the remote download instruction and use the `weather_checker.py` file included in the reviewed project. 2. If remote retrieval is operationally necessary, pin the URL to a specific immutable commit rather than the mutable `main` branch. 3. Publish and verify a SHA-256 checksum or a trusted digital signature before making the file executable. 4. Abort installation if integrity verification fails. 5. Present the downloaded content for review before execution. 6. Use a trusted release mechanism with signed, versioned artifacts. 7. Avoid combining an unverified download with installation under a trusted command name. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25` and `README.md:31` **Vulnerability Type**: Insecure dependency management **Risk Level**: Medium ### Vulnerable Code The same unpinned installation command appears in both documentation files: ```bash pip3 install requests --user ``` ### Technical Analysis The installation command resolves whichever version of `requests` is current when installation occurs. No exact version, lock file, package hash, or signature verification is specified. This makes installations non-reproducible and prevents users from confirming that they received the dependency version reviewed and tested with the project. A future compromised, malicious, or incompatible dependency release could be installed automatically. The command uses the normal package name rather than an apparent typosquatted package, and no malicious dependency was found in the project. The risk arises from unconstrained future dependency resolution and missing integrity controls. ### Attack Path 1. A user follows the documented dependency installation instructions. 2. `pip` queries the configured Python package index and selects the latest version satisfying the unconstrained package name. 3. The selected release is compromised, malicious, or unexpectedly incompatible, or the user's package-index configuration points to an untrusted source. 4. The package is installed into the user's environment. 5. Malicious installation behavior or subsequently imported package code executes with the user's privileges. ### Impact Assessment A compromised dependency could execute code with the installing or invoking user's privileges. Potential consequences include access to user files, Python environments, environment variables, application data, and network resources. The `--user` option limits installation to the user environment and does not request root access, but it can still affect every Python program under that account that resolves the insta ...[truncated 19 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Declare an audited exact dependency version in a requirements file, for example `requests==<reviewed-version>`. 2. Generate and verify package hashes, such as by using `pip install --require-hashes -r requirements.txt`. 3. Maintain a lock file so dependency resolution is reproducible. 4. Install dependencies in a dedicated virtual environment instead of the general user site-packages directory. 5. Explicitly document the trusted package index and avoid untrusted additional indexes. 6. Periodically update the pinned version after reviewing security advisories and testing compatibility. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:35
• Finding: Unnecessary System-Wide Command Installation Using Elevated Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35-36` and `README.md:38` **Vulnerability Type**: Excessive installation privilege and unsafe global symlink **Risk Level**: Medium ### Vulnerable Code ```bash sudo ln -sf $(pwd)/weather_checker.py /usr/local/bin/weather-checker ``` The same system-wide installation command is also documented in `README.md:38`. ### Technical Analysis A per-user weather utility does not require root privileges or a system-wide command. The command invokes `sudo` to create or replace an entry under `/usr/local/bin`, crossing the minimum-privilege boundary for functionality that can be provided through `~/.local/bin` or direct script execution. The global entry is a symbolic link to a file in the current working directory rather than a verified, immutable installed artifact. If the project file is later modified or replaced, the trusted-looking global command automatically resolves to the replacement. The unquoted `$(pwd)` expansion also makes the instruction unreliable when the project path contains spaces. The primary security concern, however, is the combination of unnecessary elevated filesystem modification, global exposure, and a mutable symlink target. ### Attack Path 1. A user runs the documented command with `sudo`. 2. A system-wide `/usr/local/bin/weather-checker` symlink is created or forcibly replaced. 3. The symlink points to `weather_checker.py` in a user-controlled working directory. 4. An attacker or compromised update process later replaces that target file. 5. Any local user who resolves and invokes `/usr/local/bin/weather-checker` executes the substituted code with that invoking user's privileges. This command does not cause the target Python script to execute as root by itself. Its elevated action is limited to creating or replacing the global symlink, but the resulting command broadens exposure to other local users. ### Impact Assessment The installation modifies a privileged system-w ...[truncated 450 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make user-local installation the default and remove the `sudo` instruction. 2. Install the command under `~/.local/bin`, ensuring that directory is present in the user's `PATH`. 3. Prefer copying a verified, versioned artifact over linking to a writable working-tree file. 4. If a symbolic link is retained, use a controlled user-local target and quote all paths: ```bash mkdir -p "$HOME/.local/bin" ln -sf "$(pwd)/weather_checker.py" "$HOME/.local/bin/weather-checker" ``` 5. If system-wide installation is genuinely required by an administrator, verify the source artifact first and install it into a root-controlled directory with appropriate ownership and permissions. 6. Do not use forced replacement of an existing global command unless the administrator has explicitly reviewed the existing path and approved the change. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

install requests --user

# 2. 使脚本可执行
chmod +x weather_checker.py

# 3. 创建符号链接（选择一种方式）
# 方式A：系统级安装（需要sudo）
sudo ln -sf $(pwd)/weather_checker.py /usr/local/bin/weather-checker

# 方式B：用户级安装
mkdir -p ~/.local/bin
ln -sf $(pwd)/weather_checker.py ~/.local/bin/weather-checker
# 将 ~/.local/bin 添加到 PATH 环境变量
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc  # 或 ~/.zshrc
source ~/.bashrc
```

## 使用方法

### 基本用法

```bash
# 查询北京明天的天气（默认）
weather-checker

# 查询上海明天的天气
weather-checker -c shanghai

# 查询广州后天的天气
weather-checker -c guangzhou -d 2

# 查询今天天气
weather-checker -d 0
```

### 高级用法

```bash
# 使用简单格式输出
weather-checker -f simple

# 使用JSON格式输出
weather-checker -f json

# 查询英文城市名
weather-checker -c "new york"
weather-checker -c "london"
weather-checker -c "

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 3. 创建符号链接（选择一种方式）
# 方式A：系统级安装（需要sudo）
sudo ln -sf $(pwd)/weather_checker.py /usr/local/bin/weather-checker

# 方式B：用户级安装
mkdir -p ~/.local/bin

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

sudo ln -sf $(pwd)/weather_checker.py /usr/local/bin/weather-checker

# 方式B：用户级安装
mkdir -p ~/.local/bin
ln -sf $(pwd)/weather_checker.py ~/.local/bin/weather-checker
# 将 ~/.local/bin 添加到 PATH 环境变量
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc  # 或 ~/.zshrc

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill documents network-dependent behavior and installation of a script that fetches weather data from external services, but it does not declare any tool scope or permissions for network access. This weakens transparency and policy enforcement, making it easier for users or hosting frameworks to invoke external communication without an explicit trust decision.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The natural-language documentation is entirely in Chinese, including the title, instructions, examples, and descriptive text, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy provided, forcing a specific language without user opt-in is a locale-policy violation.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 2. 下载脚本
```bash
curl -O https://raw.githubusercontent.com/yourusername/weather-checker/main/weather_checker.py
chmod +x weather_checker.py
```

• Confidence: 94% confidence
• Finding: The installation instructions tell users to download and execute code directly from a remote GitHub URL using curl, without pinning a commit, verifying a checksum, or using a signed release. If the remote content or repository is compromised, users could install and run attacker-controlled code.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 3. 创建全局命令（可选）
```bash
sudo ln -sf $(pwd)/weather_checker.py /usr/local/bin/weather-checker
```

## 使用方法

• Confidence: 93% confidence
• Finding: The documentation recommends using sudo to create a symlink in /usr/local/bin for a script downloaded from the network. Combining remote code retrieval with privileged filesystem modification increases the blast radius of mistakes or compromise, and can lead to persistence of malicious or tampered code in a trusted execution path.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The natural-language strings throughout the file are in Chinese, the geocoding request hard-codes `language="zh"`, and the forecast request hard-codes `timezone="Asia/Shanghai"`. There is no indication that the tool is intentionally region-specific or that users can opt into other language/locale settings.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 调用Open-Meteo API - 获取更多天气参数
        response = requests.get(
            "https://api.open-meteo.com/v1/forecast",
            params={
                "latitude": latitude,
                "longitude": longitude,

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This markdown file describes a tool that fetches weather data from Open-Meteo and later notes use of a geocoding API, which means user query data is transmitted over the network. The README does not include any privacy or network-disclosure warning about external API requests or what query data is sent.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The README instructs users to append a PATH export line to ~/.bashrc or ~/.zshrc and reload the shell configuration. This changes persistent user environment settings, but the documentation provides no warning that these commands modify shell startup files.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The documentation describes a weather query tool but does not clearly warn that user-supplied city queries and request metadata will be sent to external services over the network. This is a privacy and transparency issue because users may unknowingly disclose their interests or locations to third parties.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: This code transmits the user's requested city name to the Open-Meteo geocoding service, and later sends location coordinates to the forecast API. Although network access is central to the tool's purpose, the file contains no explicit user-facing warning or disclosure that input data will be sent to third-party services.

Static analysis

No suspicious patterns detected.