ClawHub
Back to skill

Security audit

免费天气技能免费版

Security checks for vulnerabilities and agentic risk

Overview

This weather skill is not malicious, but it needs review because its activation scope is much broader than weather and several command examples use unsafe networking or file-output patterns.

Review before installing. Use it only for weather queries, prefer explicit https://wttr.in URLs, avoid running its commands with elevated privileges, and choose your own safe output path instead of the documented /tmp/weather.png examples. Treat city names and coordinates as data that will be sent to third-party weather services.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:88
Finding

Weather queries are transmitted using unauthenticated plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:143
Finding

Predictable shared temporary filename permits symlink-based file overwrite

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Overly broad trigger conditions are risky because they can cause an execution-capable skill to activate in contexts far beyond weather queries. That increases the attack surface for prompt confusion and tool misuse, especially since the skill advertises exec/write capabilities and includes shell/network examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill includes examples that send user-supplied locations to external services and write output files locally, but it does not prominently warn users that data will leave the local environment or that files may be created. In agent settings, missing disclosure can lead to unintentional data transmission or filesystem side effects.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Lines L057-L059 state that the free version does not support historical data, multi-city batch queries, or scheduled push. However, L066 says the core execution capability supports '创建/查询/导出操作', and L081 asserts the documented capabilities fully cover all declared description keywords, including broad query/integration scenarios, creating an internal contradiction around supported scope. This is an intent/documentation mismatch rather than a code behavior issue because the file is declarative documentation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This code performs outbound network requests to a third-party weather API, transmitting user-selected query data such as city names or coordinates outside the agent environment. External transmission is expected for a weather skill, but it still has security relevance because it can expose sensitive locations or be triggered without sufficient user awareness.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md
# ...
def get_open_meteo(lat, lon):
    """Open-Meteo 备选方案"""
    url = "https://api.open-meteo.com/v1/forecast"
    params = {
        "latitude": lat,
        "longitude": lon,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

Multiple examples hardcode 'lang=zh', and the shell aliases/default environment settings also default to Chinese output, without clearly offering a user choice at invocation time. This can violate language/locale policy when a skill forces a specific locale rather than making it optional or explicitly user-selected.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger conditions broaden a weather-query skill into general code generation, programming assistance, testing, and deployment contexts. In an agent environment with exec/write tools, this scope expansion can cause the skill to be invoked outside its stated purpose, increasing the chance of unintended command execution or misuse under irrelevant prompts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The alias examples append 'lang=zh' automatically, and later configuration sets 'WEATHER_LANG="zh"', which establishes a forced locale by default. Without explicit opt-in or a documented language-selection choice, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The example invokes Open-Meteo directly via curl, causing outbound transmission of coordinates to an external service. While this is aligned with the skill's stated function, it remains a genuine privacy and policy concern if users are not clearly informed or if execution occurs automatically.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

bash
# 当 wttr.in 不可用时,使用 Open-Meteo
curl -s "https://api.open-meteo.com/v1/forecast?latitude=39.9&longitude=116.4&current_weather=true"

响应解析: 完成完成后,查看输出响应确认任务状态。成功时输出包含解析摘要和响应数据;失败时根据错误信息排查问题,查阅错误解析章节获取恢复步骤.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The class defines a fallback URL to an external API, indicating built-in third-party transmission as part of normal operation. In a tool-enabled agent, automatic fallback behavior can make data sharing less visible to the user and therefore more dangerous than a manual, clearly disclosed request.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md
class WeatherTool:
    def __init__(self):
        self.base_url = "https://wttr.in"
        self.fallback_url = "https://api.open-meteo.com/v1/forecast"
# ...
    def quick(self, city):
        """一行式查询"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The robust fallback example automatically switches to Open-Meteo after an exception, which can silently transmit derived location coordinates to a different external provider. Silent provider switching increases privacy and compliance risk because users may not realize their request is being retried elsewhere.

Content

Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.

md
except Exception:
        # 切换到 Open-Meteo
        coords = get_coordinates(city)
            "https://api.open-meteo.com/v1/forecast",
            params={"latitude": coords[0], "longitude": coords[1], "current_weather": True},
            timeout=30,
        ).json()

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The configuration example sets 'WEATHER_LANG="zh"' directly, which implies the skill defaults to Chinese output rather than asking or allowing neutral selection first. A hardcoded locale without explicit user opt-in can violate language policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.