Weather Pro

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:11 AM UTC
• Version: 1.4.0

Overview

It provides weather forecasts, but it loads local secrets in a way that can run unintended shell code and expose API keys.

Review before installing. Use only if you are comfortable sending city/location and derived coordinates to WeatherAPI and Sunsethue, and consider changing the script to receive only WEATHERAPI_KEY and SUNSETHUE_KEY from a controlled environment instead of sourcing ~/.openclaw/.env.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/weather-full.sh:6
• Finding: Shared credential file is evaluated as executable shell code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/weather-full.sh:6-8` **Additional Location**: `SKILL.md:83,95` **Vulnerability Type**: Overbroad credential loading and unsafe shell evaluation **Risk Level**: Medium ### Vulnerable Code ```bash if [ -f ~/.openclaw/.env ]; then source ~/.openclaw/.env fi ``` The documentation also directs users to evaluate the same shared file: ```bash source ~/.openclaw/.env && curl -s "https://api.weatherapi.com/v1/forecast.json?key=${WEATHERAPI_KEY}&q=Beijing&days=1&lang=zh&aqi=yes" ``` ```bash source ~/.openclaw/.env && curl -s "https://api.sunsethue.com/event?latitude=39.90&longitude=116.41&date=$(date +%Y-%m-%d)&type=sunset&key=${SUNSETHUE_KEY}" ``` ### Technical Analysis The Skill only requires `WEATHERAPI_KEY` and `SUNSETHUE_KEY`, but it uses `source` to evaluate the entire shared `~/.openclaw/.env` file as shell code. This exceeds the minimum access needed for the declared weather functionality. A shell environment file is not treated as passive configuration when sourced. Command substitutions, function definitions, redirections, and arbitrary shell commands in that file execute with the privileges of the user running the Skill. The process also imports unrelated values stored in the shared file, unnecessarily broadening its exposure to credentials that the Skill does not need. The reviewed code does not intentionally transmit those unrelated variables, and no malicious command is currently embedded in the package. Exploitation therefore requires another party or compromised component to gain write access to the shared environment file. ### Attack Path 1. An attacker, compromised Skill, or vulnerable local component obtains write access to `~/.openclaw/.env`. 2. The attacker adds a shell command or command substitution to the file. 3. The user invokes `scripts/weather-full.sh` or follows one of the documented raw commands. 4. Bash evaluates the entire file through `source`. 5. The injecte ...[truncated 571 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not source a shared credential file from the Skill. 2. Require the caller or Skill runtime to provide only `WEATHERAPI_KEY` and `SUNSETHUE_KEY` through a controlled environment. 3. If file-based loading is unavoidable, use a dedicated file containing only these two values and parse it as data rather than shell code. 4. Enforce restrictive file permissions, such as owner read/write access only. 5. Reject unknown variable names and malformed entries. 6. Check that both required values are present before making requests, for example: ```bash : "${WEATHERAPI_KEY:?WEATHERAPI_KEY is required}" : "${SUNSETHUE_KEY:?SUNSETHUE_KEY is required}" ``` 7. Update `SKILL.md` so its examples do not instruct users or agents to source the shared environment file. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/weather-full.sh:14
• Finding: API credentials are exposed in request URL query strings<![CDATA[ ## Vulnerability Details **File Location**: `scripts/weather-full.sh:14,43,48` **Additional Location**: `SKILL.md:83,95` **Vulnerability Type**: Credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code ```bash WEATHER_JSON=$(curl -s "https://api.weatherapi.com/v1/forecast.json?key=${WEATHERAPI_KEY}&q=${CITY}&days=${DAYS}&lang=zh&aqi=yes") ``` ```bash SUNRISE_JSON=$(curl -s "https://api.sunsethue.com/event?latitude=${LAT}&longitude=${LON}&date=${DATE}&type=sunrise&key=${SUNSETHUE_KEY}") ``` ```bash SUNSET_JSON=$(curl -s "https://api.sunsethue.com/event?latitude=${LAT}&longitude=${LON}&date=${DATE}&type=sunset&key=${SUNSETHUE_KEY}") ``` ### Technical Analysis Both API credentials are interpolated directly into URL query strings. HTTPS protects the URL while it is in transit between the client and server, but it does not prevent local or endpoint-level disclosure. Complete URLs may be visible through process inspection while `curl` is running and can be captured by shell tracing, debugging systems, HTTP proxies, API gateway logs, server access logs, monitoring platforms, crash reports, or request telemetry. Query parameters are commonly logged by default, increasing the number of locations in which credentials may persist. The requests are sent only to the two API services declared by the Skill. No transmission to an unrelated destination was identified. Nevertheless, placing reusable credentials in URLs creates unnecessary exposure wherever the API supports a safer authentication mechanism. ### Attack Path 1. A local user, monitoring agent, proxy operator, logging platform, or compromised endpoint obtains access to process details or request logs. 2. The observer captures a complete WeatherAPI or Sunsethue request URL. 3. The observer extracts the value of the `key` query parameter. 4. The recovered credential is reused to issue unauthorized requests to the corresponding service. 5. Unauthorized activity c ...[truncated 614 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use an authentication header instead of a query parameter if the corresponding API supports one. 2. If query-string authentication is mandated by the provider: - Disable command tracing around credential-bearing requests. - Prevent complete URLs from being recorded in application, proxy, and monitoring logs. - Restrict access to all logs that may contain request URLs. - Apply provider-side key restrictions, quotas, and allowlists where available. - Rotate both keys after any suspected disclosure. 3. Avoid printing commands or URLs containing credentials in documentation and troubleshooting output. 4. Keep the variables quoted and validate that they are nonempty before each request. 5. URL-encode user-controlled query values such as `CITY` and validate `DAYS` as a bounded positive integer. 6. Document that query-string authentication may expose credentials to endpoint and server-side logging when no header-based alternative exists. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Credential Access

High

• Category: Privilege Escalation

Content

### 当前天气

```bash
source ~/.openclaw/.env && curl -s "https://api.weatherapi.com/v1/forecast.json?key=${WEATHERAPI_KEY}&q=Beijing&days=1&lang=zh&aqi=yes" | jq '{
  location: .location.name,
  temp: .current.temp_c,
  condition: .current.condition.text,

• Confidence: 93% confidence
• Finding: The documented command directly sources ~/.openclaw/.env, causing all variables in that file to be loaded into the shell session before making a network request. Sourcing a broad secrets file is risky because it expands credential exposure scope and may execute unexpected shell content if the file is modified or unsafe.

Credential Access

High

• Category: Privilege Escalation

Content

### 晚霞预测

```bash
source ~/.openclaw/.env && curl -s "https://api.sunsethue.com/event?latitude=39.90&longitude=116.41&date=$(date +%Y-%m-%d)&type=sunset&key=${SUNSETHUE_KEY}" | jq '{
  quality: (.data.quality * 100 | floor),
  rating: .data.quality_text
}'

• Confidence: 93% confidence
• Finding: This example again sources ~/.openclaw/.env before invoking an external API, exposing the session to all secrets in the file and trusting the file as shell code. In context, the skill is benign, but this pattern makes credential misuse and accidental disclosure more likely than necessary.

Credential Access

High

• Category: Privilege Escalation

Content

# 用法: weather-full.sh <城市> [天数]

# 加载环境变量
if [ -f ~/.openclaw/.env ]; then
    source ~/.openclaw/.env
fi

• Confidence: 76% confidence
• Finding: Reading credentials from a local .env file is common, but sourcing that file executes it as shell code rather than merely parsing key/value pairs. If the file is modified by another local process or attacker, arbitrary commands could run in the script's context, turning credential loading into code execution.

Credential Access

High

• Category: Privilege Escalation

Content

# 加载环境变量
if [ -f ~/.openclaw/.env ]; then
    source ~/.openclaw/.env
fi

CITY="${1:-Shanghai}"

• Confidence: 76% confidence
• Finding: The direct use of source on ~/.openclaw/.env means the file contents are treated as shell script. In an agent environment, this is riskier than standard environment access because a compromised or maliciously edited file could execute attacker-controlled commands when the skill runs.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents shell-based behavior and example command execution but does not declare any explicit tool scope or permissions. This weakens reviewability and increases the chance that an agent may invoke shell access without clear user-visible authorization boundaries.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README instructs users to source a local .env file containing API keys and immediately send requests to third-party services, but it provides no warning that credentials are being loaded and used in outbound requests. This can lead to unintended credential exposure practices and poor operator awareness around secret handling.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 当前天气

```bash
source ~/.openclaw/.env && curl -s "https://api.weatherapi.com/v1/forecast.json?key=${WEATHERAPI_KEY}&q=Beijing&days=1&lang=zh&aqi=yes" | jq '{
  location: .location.name,
  temp: .current.temp_c,
  condition: .current.condition.text,

• Confidence: 86% confidence
• Finding: This command transmits user-supplied location data and an API key to api.weatherapi.com. External transmission is expected for a weather skill, but it still creates privacy and secret-handling risk, especially because the key is embedded in the request URL and the transmission is not clearly disclosed near execution guidance.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 晚霞预测

```bash
source ~/.openclaw/.env && curl -s "https://api.sunsethue.com/event?latitude=39.90&longitude=116.41&date=$(date +%Y-%m-%d)&type=sunset&key=${SUNSETHUE_KEY}" | jq '{
  quality: (.data.quality * 100 | floor),
  rating: .data.quality_text
}'

• Confidence: 86% confidence
• Finding: This command sends coordinates, date, and an API key to api.sunsethue.com. That is functionally necessary for the feature, but it is still an outbound data flow to a third party and the secret is placed in the URL without prominent disclosure or minimization guidance.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script loads local API keys from a user-specific .env file and sends user-supplied location data to third-party services without any consent prompt, privacy notice, or minimization. While expected for a weather skill, it still creates a real privacy boundary crossing and exposes precise location queries plus credentials-backed outbound requests to external providers.

External Transmission

Medium

• Category: Data Exfiltration

Content

DAYS="${2:-1}"

# 天气数据（WeatherAPI 支持中英文）
WEATHER_JSON=$(curl -s "https://api.weatherapi.com/v1/forecast.json?key=${WEATHERAPI_KEY}&q=${CITY}&days=${DAYS}&lang=zh&aqi=yes")

# 检查是否成功获取天气
if [ -z "$WEATHER_JSON" ] || echo "$WEATHER_JSON" | jq -e '.error' >/dev/null 2>&1; then

• Confidence: 90% confidence
• Finding: This request transmits user-supplied location data and an API key to an external weather provider. In the context of an agent skill, undisclosed outbound transmission can expose sensitive user intent or location information and create dependency on a third-party service outside the local trust boundary.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The WeatherAPI request hard-codes lang=zh, and all user-facing messages and usage text are in Chinese. This imposes a specific language on all users without opt-in or an explained region-specific justification, which matches the language/locale policy violation criteria.

External Transmission

Medium

• Category: Data Exfiltration

Content

DATE=$(date +%Y-%m-%d)

# 朝霞
SUNRISE_JSON=$(curl -s "https://api.sunsethue.com/event?latitude=${LAT}&longitude=${LON}&date=${DATE}&type=sunrise&key=${SUNSETHUE_KEY}")
SUNRISE_QUALITY=$(echo "$SUNRISE_JSON" | jq -r '.data.quality * 100 | floor // 0')
SUNRISE_RATING=$(echo "$SUNRISE_JSON" | jq -r '.data.quality_text // "N/A"')

• Confidence: 90% confidence
• Finding: This request sends derived latitude/longitude and date data to a second external service, expanding data sharing beyond the primary weather provider. Even though the data is used for legitimate functionality, precise coordinates can be more sensitive than a city name and increase privacy risk if users are not informed.

External Transmission

Medium

• Category: Data Exfiltration

Content

SUNRISE_RATING=$(echo "$SUNRISE_JSON" | jq -r '.data.quality_text // "N/A"')

# 晚霞
SUNSET_JSON=$(curl -s "https://api.sunsethue.com/event?latitude=${LAT}&longitude=${LON}&date=${DATE}&type=sunset&key=${SUNSETHUE_KEY}")
SUNSET_QUALITY=$(echo "$SUNSET_JSON" | jq -r '.data.quality * 100 | floor // 0')
SUNSET_RATING=$(echo "$SUNSET_JSON" | jq -r '.data.quality_text // "N/A"')

• Confidence: 90% confidence
• Finding: A second call to the same external service repeats the transmission of precise coordinates and date information for sunset calculations. Repeated third-party requests increase observability of user behavior and location-related metadata while relying on externally controlled infrastructure.

Static analysis

No suspicious patterns detected.