ClawHub
Back to skill

Security audit

KnowAir Minutely 明气分钟级降水

Security checks across malware telemetry and agentic risk

Overview

This is a small weather-forecast skill that openly uses a Caiyun API token and coordinates to fetch rain predictions.

Install only if you are comfortable using a Caiyun Weather API token and sending requested longitude/latitude coordinates to Caiyun. Keep the token scoped to this service, and review any command that deviates from the documented python3 scripts/query_minutely.py usage.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill metadata declares tools and prerequisites that clearly require environment-variable access and outbound network access, but it does not explicitly declare permissions for those capabilities. This creates a transparency and policy-enforcement gap: reviewers and users may not realize the skill can read `CAIYUN_TOKEN` and transmit user-supplied location data to an external API.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill sends precise location inputs to an external third-party weather API but does not clearly warn users about that data disclosure. Location data can be sensitive, and failing to disclose external transmission undermines informed consent and may violate privacy expectations or platform policy.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal