中国天气技能 (cn-weather) v1.0.0 发布。 - 提供中国城市天气数据，集成和风天气（QWeather）

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:53 AM UTC
• Version: 1.0.2

Overview

This weather skill performs weather reporting, but it also reads local email credentials and can send reports to a hard-coded outside email address by default.

Review before installing. Treat TOOLS.md as plaintext, keep it out of version control, avoid wildcard API host allowlists, and only run the script with an explicit intended recipient and low-privilege dedicated credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: weather_report.py:49

Finding

Plaintext Credential Storage Misrepresented as Encryption

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: weather_report.py:84

Finding

Automatic Email Delivery to an Undisclosed Hard-Coded Recipient

Content

View full analysis

1 else None main(recipient) ``` The selected recipient is subsequently passed to the email function: ```python subject = f"Daily weather report - {date_str}" send_email(recipient, subject, report) ``` ### Technical Analysis When the script is launched without a command-line recipient, it silently selects a fixed QQ email address embedded in the package. The documented default execution path does not require the user to review or confirm this destination. After loading the user's SMTP credentials, the script authenticates as the configured sender and transmits the report to the hard-coded address. The `sendmail` call also includes the sender's own address as an additional envelope recipient: ```python server.sendmail( TOOLS_CONFIG["email_sender"], [recipient, TOOLS_CONFIG["email_sender"]], msg.as_string() ) ``` No evidence establishes that the hard-coded address belongs to the user. Consequently, running the script as documented can cause an external transmission to an unexplained third-party destination. ### Attack Path 1. A user configures valid sender credentials in `TOOLS.md`. 2. The user follows the default execution instructions and runs the script without a recipient argument. 3. `main()` assigns the embedded QQ address to `recipient`. 4. The script retrieves weather information and generates a report. 5. It logs in to the SMTP service using the user's sender address ...[truncated 934 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:198

Finding

Documentation Recommends Disabling QWeather Host Restrictions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is weather retrieval, but the documented behavior also includes reading workspace secrets from TOOLS.md and sending outbound email. This mismatch is security-relevant because users and policy engines may approve the skill expecting simple API lookups, while the actual behavior expands into credential handling and exfiltration-capable delivery channels.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises network access and implicit file-reading behavior through its instructions, but it does not declare an explicit permission or allowed-tools scope. In an agent environment, missing scope declarations can cause overbroad execution authority and reduce reviewability, making it easier for the skill to access local files such as TOOLS.md and perform outbound requests without clear user visibility.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description and title present the skill as explicitly Chinese-language and China-specific, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale policy violation unless clearly justified as region-specific compliance tooling, which is not stated here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document claims secrets in TOOLS.md are encrypted, but the example instructions show plain-text storage of API keys and email authorization codes. This creates a false sense of security that may lead users to store highly sensitive credentials unprotected in the workspace, where they can be read by local tools, other skills, or accidental disclosure mechanisms.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script reads SMTP credentials from TOOLS.md even though the stated purpose is weather retrieval, expanding its privilege scope beyond what users would expect. Access to email credentials enables outbound messaging and potential misuse of a sensitive account if the skill is invoked in an untrusted context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script silently loads sensitive credentials from TOOLS.md with no meaningful runtime disclosure or consent flow. In an agent setting, hidden access to local secrets is dangerous because users may not realize the skill consumes and later uses credentials for external actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · weather_report.py (reported line 188)May include surrounding context.

python

"""Open-Meteo API（免费，无需 Key）"""
    
    def get_weather(self, city):
        url = "https://api.open-meteo.com/v1/forecast"
        params = {
            "latitude": city["lat"],
            "longitude": city["lon"],

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is described as fetching weather data, but it also sends email, which is a materially broader capability involving outbound communication to third parties. This increases risk because a user or platform may grant or trust the skill for data retrieval while it can also exfiltrate content through email, especially given the default recipient behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The documentation presents TOOLS.md handling as a secure automatic-loading mechanism and later repeats that sensitive info is 'encrypted' there, but the only concrete mechanism shown is storing secrets in a local markdown file. This creates a misleading security narrative about how secrets are actually handled, which could cause users to overtrust the setup.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The documentation claims sensitive configuration comes from TOOLS.md, yet the code hardcodes a default recipient address. This creates undisclosed outbound data flow to a fixed third party, which is risky because generated reports may be emailed automatically even when the user did not specify a recipient.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script sends city latitude/longitude to the Open-Meteo service to retrieve forecasts. While this is functionally expected for a weather script, the code provides no explicit disclosure that location data is sent to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The script makes external requests to QWeather using a sensitive API key and city identifiers, but does not clearly disclose this outbound transmission to the user. Visible disclosure is recommended for network operations involving credentials or system configuration.

Content

No source excerpt is available for this finding.