ClawHub
Back to skill

Security audit

Weather Pet Forecast

Security checks across malware telemetry and agentic risk

Overview

This weather skill appears purpose-aligned and benign, with the main caution that requested locations are sent to wttr.in for forecasting.

Install only if you are comfortable sharing weather query locations with wttr.in. Use ordinary location names or airport codes, and ensure your environment permits curl, bash, and python3 for this skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill invokes shell commands (`curl`, `python3`, `bash`) but does not declare any permissions, creating a capability mismatch that can bypass user and platform expectations about what the skill is allowed to do. In a skill that accepts user-provided locations, undeclared shell/network execution increases risk because it may enable command execution or external data access without clear consent boundaries.

External Script Fetching

High
Category
Supply Chain
Content
```bash
# JSON format for parsing (recommended)
curl -s "wttr.in/{LOCATION}?format=j1"

# Human-readable 3-day forecast
curl -s "wttr.in/{LOCATION}"
Confidence
97% confidence
Finding
curl -s "wttr.in/{LOCATION}?format=j1" # Human-readable 3-day forecast curl -s "wttr.in/{LOCATION}" ``` Extract key data for each day: - **Today** (day 0): Current + today's forecast - **Tomorrow**

External Script Fetching

High
Category
Supply Chain
Content
curl -s "wttr.in/Tokyo?format=j1" | python3 scripts/weather_analysis.py "Tokyo" --lang en

# Chinese output (for Chinese queries)
curl -s "wttr.in/Beijing?format=j1" | python3 scripts/weather_analysis.py "Beijing" --lang zh
```

**Language Options:**
Confidence
98% confidence
Finding
curl -s "wttr.in/Beijing?format=j1" | python

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal