ClawHub
Back to skill

Security audit

Amap Weather (高德天气)

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Amap weather helper, with the main caution that it handles an Amap API key and should not be used with the command-line key option on shared systems.

Use this only with an Amap Web Service API key you control. Prefer setting AMAP_API_KEY in your environment instead of passing --key on the command line, avoid logging full request URLs, and rotate the key if it was previously pasted into shell history or shared logs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/amap_weather.py:148
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis
str: key = args_key or os.environ.get("AMAP_API_KEY", "") if not key: print("错误: 未提供 API Key。请设置 AMAP_API_KEY 环境变量或使用 --key 参数。", file=sys.stderr) sys.exit(1) return key ``` ```python parser.add_argument("--key", help="高德 API Key（也可用 AMAP_API_KEY 环境变量）") ``` ```python key = get_api_key(args.key) ``` ### Technical Analysis The script permits users to supply the Amap API key through the `--key` command-line option. Command-line arguments are not an appropriate secret transport mechanism because they may be exposed through: - Process inspection interfaces and process-listing utilities. - Shell command history. - System auditing and endpoint-monitoring telemetry. - Job runners, wrapper scripts, diagnostic output, or execution logs. - Error reports that capture the complete invoked command. The key is subsequently included in an HTTPS query sent to the documented Amap endpoint. That transmission is necessary for the declared weather-query functionality and is protected in transit by TLS. No transmission to an unrelated destination was found. The vulnerability is specifically the optional command-line ingestion mechanism, not the required Amap API request. ### Attack Path 1. A user invokes the Skill with a command such as `python3 scripts/amap_weather.py Beijing --key SECRET`. 2. The shell records the command in history, or the operating system exposes the process argument vector while the process is running. 3. A local user, monitoring agent, audit service, CI system, or log collector with access to that information captures the key. 4. The observer submits requests authenticated with the exposed key to Amap services for which that key is authorized. 5. The attacker consumes ...[truncated 687 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tainted flow: 'req' from os.environ.get (line 84, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/amap_weather.py (reported line 85)May include surrounding context.

python
url = f"https://restapi.amap.com/v3/weather/weatherInfo?{params}"
    try:
        req = urllib.request.Request(url, headers={"User-Agent": "OpenClaw/1.0"})
        with urllib.request.urlopen(req, timeout=10) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.URLError as e:
        print(f"请求失败: {e}", file=sys.stderr)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documentation indicates use of environment variables and outbound network access, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates a least-privilege gap: an agent runtime may grant broader capabilities than necessary, making it easier for a compromised or modified skill flow to access secrets or perform unintended network actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The entire document is written in Chinese and does not indicate that language selection is optional or that the skill is intentionally limited to Chinese-speaking users. Under the policy rule for natural-language constraints, this can be a locale/language restriction unless the file documents user choice or a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code file contains natural-language strings for the module docstring, CLI help, warnings, and formatted output exclusively in Chinese. Under the policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.