ClawHub
Back to skill

Security audit

Weather Broadcast

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward weather-to-speech helper, but users should know it sends weather/location text to external services.

Install if you are comfortable using external weather and TTS services. Use a protected SenseAudio API key, avoid putting sensitive locations or private operational context into broadcast text, and expect the examples to create response.json and audio files locally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill sends location-derived weather text to third-party services (wttr.in and SenseAudio) without clearly warning users that their requested city and generated broadcast content will be shared externally. While the data is not highly sensitive by default, location-related inputs can still reveal user interests, whereabouts, or operational context, making undisclosed external sharing a meaningful privacy issue.

External Transmission

Medium
Category
Data Exfiltration
Content
}
    }

    resp = requests.post(TTS_URL, json=payload, headers=headers, timeout=30)
    result = resp.json()

    if result.get("data") and result["data"].get("audio"):
Confidence
90% confidence
Finding
requests.post(TTS_URL, json=

External Transmission

Medium
Category
Data Exfiltration
Content
BROADCAST_TEXT="天气播报：${WEATHER}。祝您出行愉快！"

# Call SenseAudio TTS / 调用 SenseAudio TTS
curl -X POST https://api.senseaudio.cn/v1/t2a_v2 \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
93% confidence
Finding
https://api.senseaudio.cn/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.