ClawHub
Back to skill

Security audit

彩云天气每日推送

Security checks for vulnerabilities and agentic risk

Overview

This is a weather notification skill that uses a Caiyun API token and coordinates to fetch forecasts and send messages, with no hidden or unrelated behavior found.

Install only if you are comfortable sharing your Caiyun token and precise coordinates with Caiyun and sending weather messages to the configured channel. Prefer a restricted, rotatable API token, avoid pasting full token-bearing URLs into logs or shell history, and configure any cron schedule and channel intentionally.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
daily_weather.sh:27
Finding

API Credential Exposed in a Command-Line URL

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

bash
# 快速查询当前天气
curl -s "https://api.caiyunapp.com/v2.6/${CAIYUN_TOKEN}/${LNG},${LAT}/realtime?lang=zh_CN" | python3 -c "
import sys, json
d = json.load(sys.stdin)
r = d['result']['realtime']

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · daily_weather.sh (reported line 29)May include surrounding context.

sh
echo "🔄 获取天气数据..."

# 获取综合天气数据
WEATHER=$(curl -s "${API_URL}/weather?lang=zh_CN&unit=metric&alert=true" --max-time 15)

# 解析数据
TEMP=$(echo "$WEATHER" | python3 -c "

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents capabilities that use environment variables, outbound network access, and shell commands, but it does not declare any explicit tool scope or permissions. This weakens least-privilege controls and can cause the runtime to grant broader access than users or reviewers expect, especially because the skill handles secrets like CAIYUN_TOKEN and transmits location data externally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description, headings, output examples, and API examples are all hard-coded in Chinese and use lang=zh_CN and Asia/Shanghai without indicating that language/locale is optional or user-selectable. This matches a natural-language policy concern because the skill appears to enforce a specific language/locale rather than offering a choice or clearly documenting a justified region-specific scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill sends sensitive operational data to an external service, including an API token and precise location coordinates. Even though this is expected for a weather skill, it is still a real data-exposure boundary: users' location and service credentials leave the local environment, and misuse or logging of the command could leak them.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

bash
# 快速查询当前天气
curl -s "https://api.caiyunapp.com/v2.6/${CAIYUN_TOKEN}/${LNG},${LAT}/realtime?lang=zh_CN" | python3 -c "
import sys, json
d = json.load(sys.stdin)
r = d['result']['realtime']

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This example demonstrates another external request to the Caiyun API and includes optional alert retrieval, again transmitting location and authentication data outside the system. In context this is functional, but it still represents a genuine external data flow that should be treated as security-relevant.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

bash
# 综合天气数据
curl -s "https://api.caiyunapp.com/v2.6/YOUR_TOKEN/LNG,LAT/weather?lang=zh_CN&unit=metric&alert=true"

依赖

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · daily_weather.sh (reported line 24)May include surrounding context.

sh
LOCATION="${LOCATION_NAME:-当前位置}"
CHANNEL="${1:-wechat}"

API_URL="https://api.caiyunapp.com/v2.6/${TOKEN}/${LNG},${LAT}"

echo "🔄 获取天气数据..."

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · weather_push.py (reported line 33)May include surrounding context.

python
LOCATION="${LOCATION_NAME:-当前位置}"
CHANNEL="${1:-wechat}"

API_URL="https://api.caiyunapp.com/v2.6/${TOKEN}/${LNG},${LAT}"

echo "🔄 获取天气数据..."

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The weather request hardcodes lang=zh_CN, and the script’s user-facing strings are all Chinese, which imposes a specific language/locale on all users. The file does not offer any language choice or document that this is intentionally limited to a Chinese-only audience or region-specific compliance need.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill launches an external OpenClaw CLI to send messages, which extends its effective capabilities beyond simply fetching weather data. Even if intended, invoking a local external binary increases trust and supply-chain risk because a compromised or replaced binary could execute arbitrary actions under the user's account.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · weather_push.py (reported line 137)May include surrounding context.

python
if os.path.exists(cli_path):
            try:
                cmd = [cli_path, 'message', 'send', '--channel', channel, msg]
                result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
                if result.returncode == 0:
                    print(f"✅ 消息已发送到 {channel}")
                    return True

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The HTTP request hard-codes lang=zh_CN, which enforces a specific language/locale behavior. Under the policy, locale constraints should offer user choice or be clearly documented as justified; this script does neither.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.