ClawHub
Back to skill

Security audit

get-city-weather

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate weather tool, but it sends the user's weather API key over unencrypted HTTP.

Review before installing. Use a throwaway or tightly limited Juhe weather API key, assume any key used with this version may be exposed in transit, and prefer a version that uses HTTPS and pinned dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/get_weather.py:11
Finding

Weather API Credential Transmitted over Plaintext HTTP

Content
View full analysis
&key= ``` Supplying the API key to the weather provider is necessary for the declared functionality. The network request is therefore not covert credential exfiltration and does not access unrelated secrets. However, using HTTP fails to protect both the credential and the response in transit. Any network intermediary able to observe or modify the connection—including a compromised access point, local network attacker, malicious proxy, or upstream network operator—may obtain the API key and requested city. Query-string credentials may also be retained in proxy, gateway, or server access logs. Plaintext HTTP also provides no transport integrity. An active attacker could alter the weather API response. Although the returned data is only formatted and written to a report rather than executed, this could still cause the Skill to present and persist false weather or air-quali ...[truncated 1534 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:117
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation
``` 3. Generate and verify cryptographic hashes for all resolved packages. Installation can then require hash validation: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use a trusted package index explicitly and review any organization-level package mirror configuration. 5. Regularly update pinned versions through a controlled dependency-review process rather than leaving them indefinitely outdated. 6. Run dependency vulnerability scanning against the lock file as part of release preparation. 7. Install and execute the Skill in a least-privileged virtual environment so that a dependency compromise has reduced access to the host system. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get_weather.py (reported line 16)May include surrounding context.

python
ENV_API_KEY_NAMES = ("JUHE_WEATHER_API_KEY", "WEATHER_API_KEY")
SKILL_DIR = Path(__file__).resolve().parent.parent
OUTPUT_DIR = SKILL_DIR / "output"
ENV_FILE = SKILL_DIR / ".env"

# 确保输出目录存在
OUTPUT_DIR.mkdir(exist_ok=True)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get_weather.py (reported line 34)May include surrounding context.

python
continue

def load_env_file(env_file):
    """加载简单的 .env 文件配置。"""
    if not env_file.exists():
        return

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get_weather.py (reported line 226)May include surrounding context.

python
continue

def load_env_file(env_file):
    """加载简单的 .env 文件配置。"""
    if not env_file.exists():
        return

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill documentation describes capabilities to read environment variables or a .env file, make outbound network requests, and write weather reports to local files, but it declares no explicit tool scope or permission boundaries. This creates a confused-deputy risk where an agent may invoke file, env, and network actions without clear user-visible authorization or least-privilege restrictions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description is broad enough to match ordinary conversation about weather or cities, increasing the chance of unintended invocation. In this skill, accidental activation is more meaningful because invocation leads to network access, secret usage from env/.env, and local file creation, so a benign query could cause side effects without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

整个技能描述与输出示例均固定为中文，且未说明这是用户可选项，也未明确声明该技能仅面向中文用户或特定区域合规场景。按组织语言/地区政策，若强制特定语言而无用户选择或正当说明，属于自然语言层面的策略问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The API endpoint uses plain HTTP, so the user-provided city name and, more importantly, the API key are transmitted without transport encryption. An attacker on the network path could intercept the key, observe requests, or tamper with responses, making this a real confidentiality and integrity risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description says it fetches weather information, but the code also writes a weather report to a local file without that behavior being disclosed. This creates an integrity/transparency issue and can leave user-derived data on disk unexpectedly, which is especially relevant in agent environments where file writes may have broader consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation notes API usage and output generation, but it does not prominently warn users that the skill sends city queries over the network and writes reports to local storage. Missing disclosure reduces informed consent and can lead to privacy or operational surprises, particularly in environments where outbound requests or filesystem writes are sensitive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script's natural-language interface, including its docstring, prompts, status messages, and report output, is entirely in Chinese. There is no indication that this is a region-specific tool or any opt-in mechanism allowing users to choose another language, which creates a locale policy concern.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/get_weather.py (reported line 25)May include surrounding context.

python
def configure_console_encoding():
    """优先将控制台输出切换到 UTF-8，避免 Windows 下打印 emoji 失败。"""
    for stream_name in ("stdout", "stderr"):
        stream = getattr(sys, stream_name, None)
        if not stream or not hasattr(stream, "reconfigure"):
            continue
        try:

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The manifest presents this as a weather-information skill, but the implementation includes credential-loading behavior from both a project-local .env file and process environment. While this may support API access, it is still an additional capability beyond the stated end-user purpose and should be explicitly justified or documented.

Content

No source excerpt is available for this finding.