ClawHub
Back to skill

Security audit

Korea Weather

Security checks across malware telemetry and agentic risk

Overview

This skill appears to fetch Korean weather data as advertised using a disclosed KMA API key.

Install only if you are comfortable giving the skill access to a KMA/data.go.kr service key and sending Korean weather query parameters to KMA API endpoints. Prefer a dedicated API key, keep configs containing it private, and rotate or revoke the key if it may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill explicitly requires an environment variable containing an API key and makes outbound network requests, but the metadata only declares runtime requirements and not explicit permissions. This creates a permission/transparency gap: a host or reviewer may not realize the skill can access secrets and exfiltrate them over the network, which weakens sandboxing and trust decisions even if the intended use is legitimate weather retrieval.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.