ClawHub
Back to skill

Security audit

Hong Kong Weather Information

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a straightforward Hong Kong weather skill that fetches public HKO data and keeps a small local cache, with no hidden credential use or destructive behavior found.

Install only if you want an agent to contact HKO public weather endpoints and cache public weather responses locally. This skill should not need API keys or sensitive credentials; if an installer asks you to grant secrets for it, review that mismatch before proceeding.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The instruction to always run a shell `date` command is unnecessary for a weather-information skill because time conversion can be handled inside Python or the host runtime. Requiring shell execution expands the attack surface and normalizes command execution in a context that otherwise only needs HTTP requests and parsing.

Static analysis

No suspicious patterns detected.