ClawHub
Back to skill

Security audit

current_weather

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple weather helper, but it may try to infer a user's city through third-party IP lookup without clear consent.

Install only if you are comfortable with the agent using browser-based weather lookups and you will ensure it asks for your city instead of using IP geolocation. The publisher should remove or constrain the IP lookup fallback, require explicit opt-in before contacting geolocation services, and confirm any inferred city before using it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:29
Finding

Automatic Third-Party IP Geolocation Without Explicit User Consent

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-33
Vulnerability Type: Privacy-invasive location inference
Risk Level: Medium

Evidence

The following is an English translation of the complete relevant documentation segment:

markdown
Location acquisition methods, in priority order:
1. The user directly provides it, such as "Beijing weather"
2. Retrieve a city previously provided by the user from conversation history
3. Use a browser to visit ip138.com or ip-api.com to obtain the city associated with the user's IP address

Technical Analysis

The Skill instructs the Agent to contact external IP-geolocation services when a location has not otherwise been established. Such a request discloses network metadata to third-party providers and attempts to infer sensitive location information without requiring informed user consent.

The inferred city may also be incorrect. Browser requests commonly originate from an Agent execution environment, proxy, VPN, gateway, or shared server rather than the user's device. Consequently, the service may return the infrastructure's location and the Agent may incorrectly present it as the user's location.

This behavior conflicts with the instruction at SKILL.md:113, which states that the Agent must ask the user for their city when their location is unknown. There is no code execution or privilege escalation involved; the issue is unauthorized or insufficiently disclosed processing of location-related data.

Attack Path

  1. A user asks for weather information without specifying a city.
  2. The Agent cannot obtain a reliable city from the conversation.
  3. Following the documented fallback, the Agent opens ip138.com or ip-api.com.
  4. The third-party service receives request metadata, including the public IP address visible for that request.
  5. The service derives and returns an approximate geographic location.
  6. The Agent may treat that locati ...[truncated 657 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove automatic IP-based location inference as the default fallback.
  2. When no city is known, ask the user to provide a city or region, as already required by the instruction at SKILL.md:113.
  3. If IP geolocation remains available, require explicit opt-in consent before contacting any external service.
  4. Explain which provider will be contacted, what network metadata may be disclosed, why the lookup is needed, and that the result may be inaccurate.
  5. Confirm the inferred city with the user before using or presenting it as their location.
  6. Do not retain inferred location data in persistent memory unless the user separately requests and authorizes retention.
  7. Prefer privacy-preserving weather queries based solely on a city supplied directly by the user.
  8. Document applicable third-party privacy and retention policies and restrict providers to approved HTTPS endpoints.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to determine the user's city via third-party IP lookup services such as ip138.com or ip-api.com, but it provides no user-facing notice or consent mechanism. This can expose user network metadata and inferred location to external services, creating a meaningful privacy and data-sharing risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description, triggers, and response templates are entirely written for Chinese-language interaction and do not offer any user opt-in or alternative language handling. Under the stated policy, forcing a specific language without user choice is a natural-language policy issue unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger condition includes a broad catch-all for 'other weather-related queries,' which can cause the skill to activate on loosely related prompts and initiate browsing or data collection unexpectedly. Overbroad activation increases the chance of unnecessary external requests and privacy-impacting behavior without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly directs the agent to derive user location from prior conversation context or external IP geolocation lookup. Deriving and correlating location in this way can reveal sensitive personal information and, when combined with browsing to external services, expands privacy exposure beyond what is necessary for answering a weather question.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill gives conflicting instructions about location handling: one section permits inferring location from conversation history or third-party IP lookup, while the notes later say the system must first ask the user for their city if unknown. This ambiguity is dangerous because implementations may choose the more privacy-invasive path and geolocate users without clear consent or consistent safeguards.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.