Tempest Weather

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:04 PM UTC
• Version: 1.1.0

Overview

This skill is a coherent Tempest weather integration, with some credential-handling and packaging hygiene issues users should understand before installing.

Install only if you are comfortable giving the skill access to your Tempest API token and station/device IDs. Prefer configuring TEMPEST_API_TOKEN in the environment and running the default command instead of passing --token on the command line. Developers should avoid storing .env files or private keys inside the skill directory before packaging.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_tempest_weather.py:511

Finding

API Token Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:40-45; scripts/get_tempest_weather.py:511-515
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

markdown

# Explicit station/token (current observations)
python3 scripts/get_tempest_weather.py --station-id 12345 --token "$TEMPEST_API_TOKEN"

# Explicit device/token (current observations)
python3 scripts/get_tempest_weather.py --device-id 67890 --token "$TEMPEST_API_TOKEN"

python

ap = argparse.ArgumentParser(description="Fetch current or historical weather from a Tempest station/device")
ap.add_argument("--station-id", default=os.getenv("TEMPEST_STATION_ID"))
ap.add_argument("--device-id", default=os.getenv("TEMPEST_DEVICE_ID"))
ap.add_argument("--token", default=os.getenv("TEMPEST_API_TOKEN"))
ap.add_argument("--units", default=os.getenv("TEMPEST_UNITS", "us"), choices=["us", "metric"])

Technical Analysis

The script accepts the Tempest API token through the --token command-line option, and the Skill documentation explicitly recommends invoking it this way. Although the shell expression references an environment variable, the shell expands it before process creation. The resulting token is therefore placed in the process argument vector.

Depending on host configuration, process arguments may be visible to other local users, process-monitoring services, diagnostic collectors, shell tracing, audit systems, or orchestration telemetry. This exposure is unnecessary because the script already supports reading TEMPEST_API_TOKEN directly from the environment.

The script does redact the token from successful JSON output, but that redaction does not protect the process argument vector.

Attack Path

1. A user follows the documented command and passes --token "$TEMPEST_API_TOKEN".
2. The shell expands the environment variable to the actual credential.
3. Python st ...[truncated 929 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --token option and read the credential only from TEMPEST_API_TOKEN or a dedicated permission-restricted credential source.
2. Remove the command-line token examples from SKILL.md.
3. If an explicit runtime override is required, accept the token through standard input or a protected file descriptor rather than the argument vector.
4. Avoid printing credentials in validation errors, debug logs, exception messages, and telemetry.
5. Add an automated test that verifies documented invocations do not place the token in command-line arguments.
6. Rotate the API token if it has previously been used in environments that collect process command lines.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/package_clean.sh:14

Finding

Packaging Script Can Include Local Secret Files

Content

View full analysis

Vulnerability Details

File Location: scripts/package_clean.sh:14-24
Vulnerability Type: Unintended credential inclusion in distributable archives
Risk Level: Medium

Vulnerable Code

bash

# Copy only clean files into temp folder
rsync -a \
  --exclude '.git/' \
  --exclude '**/.git/' \
  --exclude '__pycache__/' \
  --exclude '**/__pycache__/' \
  --exclude '*.pyc' \
  --exclude '*.pyo' \
  --exclude '*.skill' \
  --exclude '.DS_Store' \
  "$SKILL_DIR/" "$CLEAN_DIR/"

Technical Analysis

Despite stating that it copies “only clean files,” the packaging script copies the entire project directory and excludes only a limited set of development artifacts. It does not exclude common sensitive files such as .env, .env.*, private keys, credential exports, token files, editor backups, or other untracked local configuration.

The README instructs gateway users to store credentials in ~/.openclaw/.env, which is outside the project under normal use and is not directly read by this packaging script. Nevertheless, if a developer creates a project-local .env or another credential file for testing, the broad rsync operation will copy it into the temporary package tree. The external packaging utility is then invoked against that tree:

bash

python3 "$PACKAGE_SKILL_PY" "$CLEAN_DIR" "$SKILL_DIR"

Thus, the resulting .skill archive may contain credentials or other private files. The risk arises from broad inclusion rather than malicious behavior by the packaging utility.

Attack Path

1. A developer creates or copies a local .env, token file, private key, or other sensitive configuration under the project directory.
2. The developer runs scripts/package_clean.sh.
3. rsync copies the sensitive file because it is not covered by any exclusion.
4. package_skill.py packages the temporary directory into tempest-weather.skill.
5. The developer publishes or shares th ...[truncated 791 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace broad directory copying with an explicit allowlist containing only required release files, such as SKILL.md, README.md, approved scripts, references, and the license.
2. At minimum, exclude .env, .env.*, *.pem, *.key, *.p12, *.pfx, credential files, token files, editor backups, test outputs, and other local configuration.
3. Add a pre-package secret scan and fail packaging if probable credentials or private keys are detected.
4. Inspect and test the generated archive manifest before publication.
5. Add automated tests that create representative secret files and confirm that they are absent from the package.
6. Keep real credentials outside the repository and rotate any credential discovered in a previously distributed package.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A weather-fetching skill that actually performs packaging, rsync-based file copying, temporary-directory manipulation, and invocation of external packaging scripts represents a strong description-to-behavior mismatch. This is dangerous because users and orchestrators may authorize the skill expecting a simple API lookup, while the implementation gains broader filesystem and execution behavior that could be used to collect files, package sensitive content, or run unintended local operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence

Finding

The skill declares no explicit tool scope even though it requires environment variables and is intended to run code that can read files, write files, and access the network. Without an allowlist or permissions declaration, an agent platform may grant broader capabilities than users expect, increasing the chance of unintended secret exposure or misuse of local and network access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation phrases are broad enough to overlap with ordinary weather requests, which can cause the skill to trigger in situations where the user did not specifically intend to use a Tempest station. In context, this is less about direct code execution abuse and more about incorrect routing, privacy surprises, or unnecessary use of configured station credentials for generic weather queries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description is scoped to getting current weather conditions and quick local summaries from Tempest data. This script adds a separate historical statistics mode via --stats and --date, including day/month/year aggregation and historical summaries, which is broader than the stated manifest behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code performs outbound HTTP requests to the WeatherFlow Tempest REST API and includes an API token in the request URL/headers flow, but there is no user-facing disclosure beyond internal function names and error handling. For a code-file audit under this rule, network transmission of user or system data should have some visible warning, confirmation, or clear disclosure in the file unless it is explicitly documented as the skill's stated behavior elsewhere in scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes returning Tempest station readings such as wind, gust, rain, lightning, and local weather summaries sourced from Tempest data. The code also infers qualitative conditions like 'Sunny' or 'Overcast' from light/radiation heuristics, which goes beyond directly reporting station readings and is not disclosed in the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.