ClawHub
Back to skill

Security audit

StormProof — NOAA Hurricane Weather Lookup

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed property-specific weather lookup that shares an address and storm date with an external NOAA lookup service only after user consent.

Before using this skill, be comfortable sharing the property address and storm date with hurricaneinspections.com, where the request may be logged. Use it only for addresses you are authorized to submit, and decline the lookup if you prefer general NOAA storm information without sending an exact address.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
**Where it goes:**

- Endpoint: `https://api.hurricaneinspections.com/api/preview`
- Operator: Oasis Engineering / hurricaneinspections.com (a Florida-registered Licensed PE practice)
- The endpoint is a Cloudflare Worker that queries NOAA ASOS/AWOS and CO-OPS tide gauges on the caller's behalf
Confidence
98% confidence
Finding
https://api.hurricaneinspections.com/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.