ClawHub
Back to skill

Security audit

Weather

Security checks for vulnerabilities and agentic risk

Overview

This is a simple weather lookup skill whose main risk is that its example commands may send requested locations over unencrypted HTTP.

Before installing, be aware that the skill sends weather locations to wttr.in. Prefer changing the examples to use https://wttr.in and curl options that require HTTPS, especially for private travel or location queries.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:40
Finding

Weather requests use unencrypted HTTP transport

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-48
Vulnerability Type: Cleartext transmission to an external weather service
Risk Level: Low

Vulnerable Code

bash
# One-line summary
curl "wttr.in/London?format=3"

# Detailed current conditions
curl "wttr.in/London?0"

# Specific city
curl "wttr.in/New+York?format=3"

The same URL pattern without an explicit HTTPS scheme is repeated in the other command examples in SKILL.md.

Technical Analysis

The documented curl commands omit the URL scheme. For an address such as wttr.in/London, curl defaults to HTTP, causing the initial request to use cleartext transport. Even if the service subsequently redirects the client to HTTPS, the original request has already been exposed and the unauthenticated redirect can be manipulated by an on-path attacker.

Weather queries can disclose a user's city, region, airport code, or intended travel destination. Cleartext HTTP also provides no reliable integrity protection, allowing a network attacker to intercept the request, alter the response, or redirect the client to an attacker-controlled endpoint.

Attack Path

  1. A user asks the agent for weather information about a location.
  2. The agent follows the skill documentation and executes a command such as curl "wttr.in/New+York?format=3".
  3. curl initiates an unencrypted HTTP connection to the remote service.
  4. An attacker controlling or monitoring the local network, proxy, DNS path, or another upstream network segment observes the requested location.
  5. An active attacker can modify the HTTP response or redirect the request to an attacker-controlled service.
  6. The agent may present manipulated weather information to the user as if it came from the legitimate service.

Impact Assessment

Exploitation does not grant local system privileges or code execution by itself. Its scope is limited to the confidentiality and integrity o ...[truncated 250 chars]

Remediation
View remediation

Remediation Suggestions

Replace every wttr.in URL with an explicit HTTPS URL. Configure curl to reject protocol downgrades and report request failures:

bash
curl --fail --silent --show-error --proto '=https' \
  "https://wttr.in/London?format=3"

Apply the same change to all current-weather, forecast, formatting, quick-response, and airport-code examples in SKILL.md. If redirects must be followed, restrict them to HTTPS as well:

bash
curl --fail --silent --show-error --location \
  --proto '=https' --proto-redir '=https' \
  "https://wttr.in/London?format=3"

Do not disable TLS certificate validation. Where location confidentiality is important, inform users that their requested location will be sent to the third-party weather provider.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.