ClawHub
Back to skill

Security audit

Free Weather Api Tool Free

Security checks across malware telemetry and agentic risk

Overview

This is mainly a weather lookup skill, but it requests broad execution/write capability and has generic triggers that could activate it outside weather tasks.

Review before installing. Use only for weather lookups, and be aware that city/location queries are sent to external weather services. If installed, avoid letting it handle unrelated data-analysis tasks and treat local caching as storing location query history unless you disable or remove it yourself.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The trigger conditions are unrelated to the advertised weather capability and are broad enough to activate the skill for generic data-analysis, reporting, and visualization tasks. In an agent ecosystem, overbroad triggers can cause the wrong skill to run, leading to unintended network calls, file operations, or execution paths because this skill declares read/write/exec capabilities.

Vague Triggers

High
Confidence
93% confidence
Finding
The trigger text is excessively broad and mismatched to actual functionality, which increases the chance of accidental invocation by unrelated prompts. Because the manifest exposes powerful tools including write and exec, mis-triggering is more dangerous than a harmless UX issue: it can route unrelated user tasks into a skill that performs network access and local side effects.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill instructs users to send location queries to external weather services and later includes local cache/write and export/save behaviors, but it does not clearly disclose outbound data transmission or local persistence. In agent environments, lack of disclosure can surprise users and cause inadvertent sharing of sensitive locations or retention of query history on disk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.