Alibabacloud Iqs Weather Query

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:41 AM UTC
• Version: 0.0.1

Overview

This weather skill is mostly coherent, but it needs review because it tells agents to persistently rewrite its own parser code based on untrusted webpage text.

Review before installing. Use the weather query only if you are comfortable sending city queries and selected page URLs to Alibaba Cloud IQS, and do not allow the agent to automatically edit scripts/weather.mjs from raw webpage content. Parser additions should be made only through an explicit, human-reviewed update process.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:178

Finding

Untrusted Web Content Is Used to Direct Persistent Modification of Executable Skill Code

Content

View full analysis

**Key:** The skill gets smarter with every new city searched. Each raw-mode encounter is an opportunity to add a new parser, progressively covering more site formats. ``` The corresponding implementation in `scripts/weather.mjs` returns up to 4,000 characters of remotely retrieved page content as `rawText` and pairs it with an `evolveHint` directing the agent to create a parser and register it in the executable script. ### Technical Analysis The page selected by the search service may be an unknown or attacker-controlled website. Its content is consequently untrusted. Although the current Node.js script does not itself execute instruction ...[truncated 3158 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

node scripts/weather.mjs <city>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

node scripts/weather.mjs <city>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

node scripts/weather.mjs <city>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

node scripts/weather.mjs <city>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

node scripts/weather.mjs <city>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md

node scripts/weather.mjs <city>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md

node scripts/weather.mjs <city>

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill describes self-modification behavior where the agent first processes untrusted content and then changes the skill for future runs, without clear user warning or consent. Silent persistence of behavior changes is dangerous because it can introduce unauthorized code paths, drift from the original security posture, and make compromise durable across sessions.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The raw-mode flow explicitly encourages the agent to consume untrusted webpage text, answer the user, and then generate and register new parser code from that content. This is a classic unsafe self-modification pattern: externally sourced data can shape persistent logic, enabling prompt injection, malicious parser generation, or long-term compromise of future executions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill documents use of environment variables and outbound network access, but it does not declare any explicit tool scope or allowed-tools boundary. That weakens least-privilege controls and makes the runtime capabilities broader and less auditable than the skill contract suggests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The pre-check output and explanation use Chinese string literals (API Key 未配置, API Key 已配置(已脱敏)) and later examples and hints also assume Chinese-language interaction, but the document does not state that the skill is Chinese-only or offer an alternative language. This creates a natural-language policy concern because the skill effectively enforces a locale/language choice without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

>
> **Option 2: Permanent (recommended)**
>
> Add to ~/.zshrc or ~/.bashrc:
> ```bash
> export ALIYUN_IQS_API_KEY="your-api-key-here"
> ```

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation tells the agent to write new parser code and register it based on previously seen content, which is unnecessary for a weather-query skill's core function. This turns passive content ingestion into code modification, creating a path for untrusted webpage structure or prompt-like text to influence future executable behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Natural-language strings in the file, including the description, usage, prompts, parsing assumptions, and output messages, are all hard-coded in Chinese. This imposes a specific language/locale on users without any opt-in or documented justification, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code sends the user-supplied city name to the UnifiedSearch API and later sends the selected weather page URL to the ReadPage API, which may disclose user interest/location context and remote browsing targets to a third-party service. Although the script logs progress, it does not clearly warn the user that their query and target URL are being transmitted externally for processing.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The raw fallback explicitly instructs the agent to first answer using untrusted page text and then derive and add new code from that same text. This staged workflow is dangerous because hostile or malformed content from a third-party webpage can become an input to code-authoring behavior, enabling prompt injection to influence future logic changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The raw-mode fallback embeds an instruction telling the agent to write and register new parser code based on untrusted webpage content. That crosses the boundary from data extraction into self-modification and creates an indirect prompt/code-generation channel where attacker-controlled page text can influence future code changes.

Content

No source excerpt is available for this finding.

Ssd 1

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The evolveHint encourages the agent to treat webpage-derived rawText as material for writing a new parser and updating the parser registry. Since the page content is untrusted and potentially attacker-controlled, this creates a semantic trust inversion where external content can steer code-writing behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/weather.mjs:34