ClawHub
Back to skill

Security audit

Weather Pollen

Security checks across malware telemetry and agentic risk

Overview

This skill appears to only fetch weather and pollen data, but it is configured for a fixed/default location rather than truly looking up any arbitrary place.

Install this only if you are comfortable with it contacting Open-Meteo and Pollen.com and if you want reports for the configured/default area. Do not rely on the location argument for arbitrary-city accuracy unless the skill is updated to geocode locations and query pollen by the requested place.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill explicitly depends on network access via curl and reads configuration from environment variables, yet those capabilities are not declared as permissions. Undeclared capabilities reduce transparency and can bypass user or platform expectations about what the skill is allowed to access, making review and policy enforcement weaker.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "Seth Rose",
  "license": "MIT",
  "dependencies": {
    "zod": "^4.3.5"
  }
}
Confidence
94% confidence
Finding
"zod": "^4.3.5"

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
logic.ts:5