ClawHub
Back to skill

Security audit

OpenWeather CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for an OpenWeatherMap CLI, but its install instructions build and install a mutable third-party GitHub project without pinning or integrity verification.

Review the referenced GitHub repository before installing, prefer a pinned reviewed commit or signed release, and avoid exposing unrelated environment variables when running owget. Treat the OpenWeather API key as sensitive, especially when using debug output.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:25
Finding

Mutable Remote Source Is Retrieved and Installed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-29
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
git clone https://github.com/ParinLL/OpenWeatherMap-script.git
cd OpenWeatherMap-script
go install .

Technical Analysis

The recommended installation procedure clones the current default branch of a third-party GitHub repository and installs the resulting Go program without pinning a reviewed commit, verifying a cryptographic checksum, or validating a signed release.

The effective installed payload can therefore change after this skill has been audited. Although go install . does not ordinarily execute the installed application's runtime logic during compilation, it produces and installs an executable from mutable remote source. When the user subsequently invokes owget, that executable runs with the user's privileges and receives access to the required OPENWEATHER_API_KEY.

The project contains only SKILL.md; the referenced implementation is not included. Consequently, this audit cannot verify the external executable's network behavior or the document's assertion that sensitive parameters such as appid are redacted from debug output.

Attack Path

  1. An attacker compromises the referenced GitHub account or repository, or introduces a malicious revision into its default branch.
  2. A user or agent follows the documented git clone command, retrieving the attacker's current source instead of a previously reviewed revision.
  3. go install . compiles and installs the modified owget executable in the user's Go binary directory.
  4. The user invokes owget for weather, forecast, or geocoding operations.
  5. The malicious executable runs with the user's account privileges and can access OPENWEATHER_API_KEY, command arguments, accessible files, and network resources.
  6. It may exfiltrate the API key or other accessible infor ...[truncated 839 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the source to an immutable, reviewed commit hash rather than cloning and building the repository's current default branch.
  2. Prefer a versioned, signed release artifact from a trusted publisher.
  3. Publish expected SHA-256 or stronger cryptographic checksums and require verification before installation.
  4. Vendor the reviewed source into the skill package when feasible so that the audited content matches the installed content.
  5. Review and lock Go module dependencies, including validating go.mod and go.sum, before building.
  6. Document the exact reviewed version and provide reproducible build instructions.
  7. Verify the implementation's credential-redaction behavior rather than relying solely on documentation, particularly for debug URLs and error messages.
  8. Run the executable without administrative privileges and expose only the minimum required environment variables.
  9. A hardened installation example should check out a specific reviewed commit and verify it before installation:
bash
git clone https://github.com/ParinLL/OpenWeatherMap-script.git
cd OpenWeatherMap-script
git checkout --detach VERIFIED_COMMIT_HASH
test "$(git rev-parse HEAD)" = "VERIFIED_COMMIT_HASH" || exit 1
go install .

Replace VERIFIED_COMMIT_HASH with an explicitly documented and independently reviewed commit identifier.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.