ClawHub
Back to skill

Security audit

Xiao Chuang You Weather

Security checks across malware telemetry and agentic risk

Overview

This is a coherent weather helper skill, with manageable privacy and routing notes around inferred location and broad trigger words.

Safe for ordinary weather use. Before installing, consider specifying the city yourself and avoid relying on remembered location if you do not want location hints reused for external weather lookups.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The activation list includes very common standalone terms such as “热”, “冷”, “空气”, and “质量”, which can cause the weather skill to trigger in unrelated conversations. This creates an invocation-confusion risk where user requests may be misrouted, leading to inappropriate handling and unexpected data access or network calls.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to infer the user’s location from conversation history or MEMORY.md and send a city-derived request to an external service (`wttr.in`) without any disclosure or consent mechanism. That creates a privacy issue because location information, even at city granularity, can be sensitive and users are not warned that their derived location will be transmitted off-platform.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.