ClawHub
Back to skill

Security audit

ClawWeather Pro

Security checks across malware telemetry and agentic risk

Overview

This weather skill is mostly coherent, but its paid premium script can send a spending-capable API key to an environment-selected endpoint, so it needs review before install.

Review this before installing if you plan to use the premium feature. Treat X402_API_KEY like a payment credential, verify the paid API endpoint out of band, avoid setting X402_BASE unless you fully trust the destination, and do not enable X402_ALLOW_HTTP except in a controlled test environment. The free weather scripts mainly expose city or hub choices to third-party weather services.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tainted flow: 'req' from os.environ.get (line 37, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
url = BASE.rstrip("/") + "/v1/trading-weather?" + urllib.parse.urlencode(params)
    req = urllib.request.Request(url, headers={"x-api-key": KEY})
    try:
        with urllib.request.urlopen(req, timeout=30) as r:
            return json.loads(r.read().decode())
    except urllib.error.HTTPError as e:
        print(f"ERROR: HTTP {e.code}: {e.read().decode()[:200]}")
Confidence
94% confidence
Finding
with urllib.request.urlopen(req, timeout=30) as r:

External Transmission

Medium
Category
Data Exfiltration
Content
def get_open_meteo(lat: float, lon: float) -> dict:
    url = (f"https://api.open-meteo.com/v1/forecast?latitude={lat}&longitude={lon}"
           "&current_weather=true&daily=weathercode,temperature_2m_max,temperature_2m_min&timezone=auto")
    try:
        with urllib.request.urlopen(url, timeout=15) as r:
Confidence
84% confidence
Finding
https://api.open-meteo.com/

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.