ClawHub
Back to skill

Security audit

AWEKAS Wetter API

Security checks across malware telemetry and agentic risk

Overview

This skill appears to perform the advertised AWEKAS weather lookup, but users should handle the API key carefully.

Install only if you are comfortable giving the skill an AWEKAS API key. Prefer a dedicated or easily revocable key, pass it through an environment variable when possible, and avoid sharing logs or error traces that might include request URLs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill explicitly requires an AWEKAS API key but provides no warning about secure handling, transmission, storage, or logging of that credential. In a network-enabled skill, missing credential-handling guidance can lead users or downstream tooling to expose the key in shell history, logs, screenshots, or insecure sharing, resulting in unauthorized API use.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill takes an API key from user input or environment and places it into the URL query string before sending the request. Even over HTTPS, query parameters are more likely to be exposed in logs, proxies, monitoring systems, browser/history equivalents, and error traces than headers or body fields, so this increases the chance of credential leakage.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
awekasCurrent.js:46