ClawHub
Back to skill

Security audit

OpenWeatherMap Weather

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward weather skill that uses OpenWeatherMap as disclosed and does not include hidden code or installation behavior.

Install only if you are comfortable sharing weather query locations with OpenWeatherMap and providing an API key. Prefer city-level queries over precise coordinates when possible, and use a dedicated API key that can be rotated if exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
### By City Name
```
GET https://api.openweathermap.org/data/2.5/weather?q={city},{country_code}&appid={API_KEY}&units={units}
```

### By Coordinates
Confidence
89% confidence
Finding
This skill sends user-supplied location data and an API key to an external third-party service. External transmission is expected for a weather skill, but it still creates privacy and secret-handling risk because sensitive data may be disclosed to the provider or exposed through unsafe request construction/logging.

External Transmission

Medium
Category
Data Exfiltration
Content
### By Coordinates
```
GET https://api.openweathermap.org/data/2.5/weather?lat={lat}&lon={lon}&appid={API_KEY}&units={units}
```

### Parameters
Confidence
89% confidence
Finding
The coordinates-based request transmits precise latitude and longitude to an external service along with the API key. Precise coordinates can be more sensitive than city names, increasing privacy impact if used without clear user awareness or minimization.

External Transmission

Medium
Category
Data Exfiltration
Content
## Forecast API (5 Day / 3 Hour)

```
GET https://api.openweathermap.org/data/2.5/forecast?q={city}&appid={API_KEY}&units=imperial
```

Returns forecast data in 3-hour intervals for 5 days.
Confidence
86% confidence
Finding
The forecast endpoint also transmits user location queries and the API key to a third-party service. This is contextually expected for a weather skill, so it is less suspicious than in unrelated skills, but it still represents a real external data-sharing surface that should be disclosed and controlled.

Static analysis

No suspicious patterns detected.