ClawHub
Back to skill

Security audit

NINA Warnings

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently checks public German warning data and local ARS lookups without credentials, persistence, or system changes.

Install only if you want an agent to run the bundled shell scripts to query the public German NINA warning API. It does not need secrets or private accounts, but it does require network access to warnung.bund.de and uses German-region ARS data; users may want the documentation inconsistency around the bundled ARS cache fixed for clarity.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description says the skill provides read-only access to current German public warnings from the official NINA / warnung.bund.de API. However, this code chunk is only a local helper script for resolving place or district names to ARS codes using a cached JSON reference file. While ARS lookup may support a warning-check workflow, the actual behavior in this chunk is materially narrower and different from the declared primary purpose: it neither contacts the official warning API nor returns warning data. Therefore this chunk does not accurately match the declared purpose.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
5. Use `--source <name>` for nationwide feeds like `mowas`, `dwd`, `katwarn`, `biwapp`, `lhp`, or `police`.
6. Summarize the result clearly:
   active warnings, sender, severity, effective time, expiry if present.
7. If there are no warnings, say so plainly.

## Output Guidance / Ausgabehinweise

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

md
## English

`nina-warnings` is a small, read-only OpenClaw skill for current German public warning messages via the official BBK NINA API at `warnung.bund.de`.
The package is intentionally prepared for a conservative ClawHub release: no write operations, no secrets, no local persistence, and only public read access.

Repository: [openclaw-skill-nina-warnings](https://github.com/wolf128058/openclaw-skill-nina-warnings)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes shell-based helper scripts and depends on bash/curl/jq, but it does not declare an explicit tool scope such as allowed shell usage. That creates a governance gap: the runtime may grant broader execution capability than reviewers or policy systems expect, increasing the risk of unintended command execution or future script changes expanding behavior without matching permission metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script emits fixed German-language status and help text such as 'Kein ARS-Code gefunden' and 'Häufige ARS-Codes' with no option to select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The main output heading and field label 'Bundesland' are hard-coded in German, requiring all users to interact with a specific language. There is no visible opt-in, locale detection, or justification that this tool is intentionally region- or language-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's user-facing usage text and later status output use German-only strings such as location descriptions and warning labels, and the warning extraction also prefers .label.de and .i18nTitle.de. This enforces a specific language/locale for users without any opt-in or explanation that the skill is intentionally German-region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The invocation guidance says to use the skill for broad phrases like 'weather warnings', 'flood warnings', and 'whether there are active warnings for a German city'. These are common user requests that may match contexts outside the intended NINA/public-warning scope, and the file does not provide exclusion conditions or negative examples to narrow activation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation first describes references/ars-codes.json as an 'Empty cache placeholder' to be populated during setup, then later states that the same file already contains the 16 German state capitals as bundled starter entries. These statements cannot both be true, so the documentation contradicts itself about the actual packaged behavior.

Content

No source excerpt is available for this finding.