和风天气

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:18 AM UTC
• Version: 0.5.0

Overview

This is a straightforward QWeather lookup skill with disclosed credentials and CLI installation requirements, though users should be mindful that it installs an external Cargo binary.

Install only if you trust the qweather Cargo package or repository, prefer a reviewed pinned version when possible, and keep QWEATHER_PRIVATE_KEY and related variables limited to the environment where the weather CLI runs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–28
Vulnerability Type: Unpinned executable dependency and mutable upstream source
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw":{"requires":{"env":["QWEATHER_KID","QWEATHER_PROJECT_ID","QWEATHER_PRIVATE_KEY","QWEATHER_BASE_URL","QWEATHER_GEO_URL"]},"primaryEnv":"QWEATHER_PRIVATE_KEY","homepage":"https://github.com/yinguobing/qweather-skill","install":[{"id":"qweather","kind":"cargo","package":"qweather","bins":["qw"],"label":"Install qweather via cargo"}]}}

bash

cargo install qweather

bash

cargo install --git https://github.com/yinguobing/qweather-skill.git

Technical Analysis

The Skill directs users or agents to download, compile, and install an executable from external sources without pinning an exact crate version, immutable Git commit, or verified artifact digest. The registry installation resolves package content available at installation time, while the Git installation resolves the repository's current default revision.

Because the executable source and dependency lock material are not included in the audited project, the behavior of the installed qw binary cannot be verified from this package. Upstream content may change after the Skill has been reviewed. The Git command is particularly mutable because it does not specify a commit with --rev; the registry command similarly lacks an exact reviewed version.

This is a supply-chain weakness rather than evidence that the current upstream package is malicious.

Attack Path

1. An attacker compromises the upstream crate publisher account, source repository, release workflow, or a transitive dependency.
2. The attacker publishes or commits modified code under the expected qweather package or repository identity.
3. A user or agent follows the documented unpinned installation command.
4. Cargo retrieves and compiles the attacker-controll ...[truncated 832 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the registry dependency to a reviewed exact version rather than resolving the latest available release.
2. For Git installation, specify a reviewed immutable commit using --rev <full-commit-hash>.
3. Use Cargo's locked dependency resolution where supported, and publish the reviewed Cargo.lock file.
4. Distribute checksums or cryptographic signatures for release artifacts and verify them before installation.
5. Include the relevant source code and dependency manifest in the Skill package so the executable behavior can be audited together with the instructions.
6. Perform installation and execution under a dedicated, least-privileged account with only the file and network permissions required for weather queries.
7. Restrict access to QWEATHER_PRIVATE_KEY and avoid exposing unrelated secrets to the installation or execution environment.
8. Add a documented update process requiring security review before changing the pinned version or commit.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The markdown states --lang defaults to zh, which establishes a language preference by default. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly justified or optionalized in the user-facing behavior.

Content

No source excerpt is available for this finding.