ClawHub
Back to skill

Security audit

Weather Pollen

Security checks for vulnerabilities and agentic risk

Overview

The skill is not destructive, but it can label fixed Anna, TX weather and pollen data as if it came from another requested location.

Install only if you want reports for Anna, TX or a single configured weather location, and do not rely on the location argument for true location-based results. The skill should be updated to either geocode requested locations and configure pollen by location, or clearly advertise itself as fixed-location only.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill uses environment variables and network access but does not explicitly declare corresponding permissions, which weakens transparency and policy enforcement around sensitive capabilities. While weather and pollen lookups legitimately need network access and configured coordinates may reasonably use env vars, undeclared capabilities can mislead reviewers and users about what the skill is able to access.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill claims to support weather and pollen for any user-specified location, but the actual behavior appears tied to fixed coordinates and a hardcoded ZIP code, with the location argument only affecting displayed text. This can mislead users into trusting incorrect location-based health or weather information, which is especially risky for pollen-sensitive users making health-related decisions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "Seth Rose",
  "license": "MIT",
  "dependencies": {
    "zod": "^4.3.5"
  }
}
Confidence
90% confidence
Finding
The dependency is specified with a caret range (^4.3.5), which allows newer compatible versions to be installed over time rather than a single fixed version. This can introduce supply-chain risk and reduce build reproducibility if a later published version contains a regression or malicious code, although the risk is limited here because the file only declares a common library dependency and shows no other suspicious behavior.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
logic.ts:5