ClawHub
Back to skill

Security audit

xiaomi-weather

Security checks across malware telemetry and agentic risk

Overview

This is a weather lookup skill with disclosed network use; the main issue is a low-risk temporary city-cache file that should be hardened.

Install only if you are comfortable with the skill sending weather queries to Xiaomi's weather API and downloading a fallback city list from GitHub when a city is not built in. The maintainer should move the city cache to a per-user cache directory with restrictive permissions, but the current behavior is coherent with the stated weather lookup purpose.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The script silently downloads remote content into a predictable file in /tmp, a shared world-writable location, without disclosure or integrity validation. This creates tampering and trust-boundary risks: another local process could pre-place or alter the cache file, causing incorrect city resolution and unintended outbound requests, and users are not informed that extra third-party network access and local caching occur.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.