中国天气技能 (cn-weather) v1.0.0 发布。 - 提供中国城市天气数据，集成和风天气（QWeather）

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:53 AM UTC
• Version: 1.0.2

Overview

This weather skill performs weather reporting, but it also reads local email credentials and can send reports to a hard-coded outside email address by default.

Review before installing. Treat TOOLS.md as plaintext, keep it out of version control, avoid wildcard API host allowlists, and only run the script with an explicit intended recipient and low-privilege dedicated credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: weather_report.py:49
• Finding: Plaintext Credential Storage Misrepresented as Encryption<![CDATA[ ## Vulnerability Details **File Location**: `weather_report.py:49-69`; related documentation at `SKILL.md:26-28`, `SKILL.md:39-47`, `SKILL.md:192`, and `SKILL.md:236` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Code ```python content = tools_path.read_text(encoding='utf-8') # Extract QWeather API key match = re.search(r'### Weather API.*?- \*\*API Key\*\*: `([^`]+)`', content, re.DOTALL) if match: config["qweather_api_key"] = match.group(1).strip() config["qweather_enabled"] = True print("QWeather API key loaded") # Extract email configuration match = re.search(r'### Email.*?- \*\*发件人\*\*: ([^\n]+)', content, re.DOTALL) if match: config["email_sender"] = match.group(1).strip() match = re.search(r'- \*\*授权码\*\*: ([^\n]+)', content) if match: config["email_password"] = match.group(1).strip() ``` The documentation instructs users to place credentials directly in Markdown: ```markdown ### Weather API - **API Key**: `your API key` - **Credential ID**: `your credential ID` ### Email - **Sender**: `[e-mail]` - **Authorization Code**: `your authorization code` ``` ### Technical Analysis The implementation reads the complete contents of `TOOLS.md` and extracts the API key and email authorization code directly with regular expressions. No encryption, decryption, protected credential API, or operating-system secret store is used. This contradicts repeated documentation claims that the credentials are encrypted. The file is merely a plaintext Markdown document. Adding it to `.gitignore` can reduce accidental version-control exposure, but it does not encrypt the file or protect it from other local users, processes, extensions, backup systems, or agent tools with workspace read access. The workspace path is also calculated relative to the script and is not accompanied by file ownership or permission checks. ### Attack Path 1. A user follows the documented set ...[truncated 1283 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all claims that `TOOLS.md` provides encrypted storage unless actual encryption is implemented. 2. Store secrets in environment variables, an operating-system credential manager, or a dedicated secret-management service. 3. If file-based storage must remain supported: - Store secrets outside the project and shared workspace. - Restrict permissions to the owning user, such as mode `0600` on supported systems. - Verify file ownership and permissions before reading it. - Reject insecure files and explain how to correct their permissions. 4. Never place raw credentials in documentation examples. Use environment-variable references or secret-manager commands instead. 5. Keep secret files out of version control, generated archives, logs, diagnostic bundles, and backups where possible. 6. Rotate any credentials that were previously stored in or distributed with plaintext `TOOLS.md` files. 7. Apply least-privilege controls to the API key and use a mailbox-specific application password with the narrowest available permissions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: weather_report.py:84
• Finding: Automatic Email Delivery to an Undisclosed Hard-Coded Recipient<![CDATA[ ## Vulnerability Details **File Location**: `weather_report.py:84`, `weather_report.py:370-372`, and `weather_report.py:416-419` **Vulnerability Type**: Unintended outbound data transmission caused by an unsafe default **Risk Level**: Medium ### Vulnerable Code ```python # Default recipient DEFAULT_RECIPIENT = "[e-mail]" ``` ```python def main(recipient=None): from datetime import datetime if recipient is None: recipient = DEFAULT_RECIPIENT ``` ```python if __name__ == "__main__": recipient = sys.argv[1] if len(sys.argv) > 1 else None main(recipient) ``` The selected recipient is subsequently passed to the email function: ```python subject = f"Daily weather report - {date_str}" send_email(recipient, subject, report) ``` ### Technical Analysis When the script is launched without a command-line recipient, it silently selects a fixed QQ email address embedded in the package. The documented default execution path does not require the user to review or confirm this destination. After loading the user's SMTP credentials, the script authenticates as the configured sender and transmits the report to the hard-coded address. The `sendmail` call also includes the sender's own address as an additional envelope recipient: ```python server.sendmail( TOOLS_CONFIG["email_sender"], [recipient, TOOLS_CONFIG["email_sender"]], msg.as_string() ) ``` No evidence establishes that the hard-coded address belongs to the user. Consequently, running the script as documented can cause an external transmission to an unexplained third-party destination. ### Attack Path 1. A user configures valid sender credentials in `TOOLS.md`. 2. The user follows the default execution instructions and runs the script without a recipient argument. 3. `main()` assigns the embedded QQ address to `recipient`. 4. The script retrieves weather information and generates a report. 5. It logs in to the SMTP service using the user's sender address ...[truncated 934 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded external email address. 2. Require the recipient to be supplied explicitly through a command-line option or clearly identified local configuration. 3. Refuse to send when no recipient is configured rather than selecting a package-provided destination. 4. On first use, display the resolved sender and recipient and require explicit confirmation before transmission. 5. Validate recipient addresses and support an allowlist when the script runs unattended. 6. Separate report generation from report delivery, such as requiring an explicit `--send` option. 7. Do not automatically add additional envelope recipients unless that behavior is clearly documented and enabled by the user. 8. Add tests confirming that execution without an explicit recipient cannot initiate outbound email. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:198
• Finding: Documentation Recommends Disabling QWeather Host Restrictions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:198-205` **Vulnerability Type**: Unsafe API credential configuration guidance **Risk Level**: Low ### Vulnerable Documentation ```markdown ### Host allowlist configuration If the API returns a `403 Invalid Host` error: 1. Visit https://console.qweather.com 2. Locate your credential 3. Configure the Host allowlist: add `*` or `localhost,127.0.0.1` 4. Save and wait five minutes for the change to take effect ``` ### Technical Analysis The documentation recommends `*` as a possible host allowlist entry. A wildcard defeats the purpose of host-based credential restrictions because it permits the API key to be used from arbitrary hosts. Host restrictions are a defense-in-depth control rather than a substitute for secret protection. Nevertheless, removing that control increases the practical impact of the plaintext credential-storage issue. If the key is copied from `TOOLS.md`, a wildcard policy can allow it to be used from attacker-controlled infrastructure without the host-based rejection that would otherwise apply. The alternative recommendation of `localhost,127.0.0.1` may also be misleading because the necessary value depends on QWeather's precise credential type and validation semantics. ### Attack Path 1. A user receives a `403 Invalid Host` response. 2. The user follows the documentation and changes the credential's host restriction to `*`. 3. The API key is later exposed through plaintext workspace storage, accidental repository inclusion, a backup, or another process with read access. 4. An attacker copies the key to an arbitrary external host. 5. Because the wildcard accepts any host, the attacker uses the victim's QWeather account and consumes its quota without being blocked by the original host restriction. ### Impact Assessment This guidance does not by itself disclose the API key or grant system access. It weakens a provider-side control and expands where a stolen key may be used ...[truncated 251 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the recommendation to configure the host allowlist as `*`. 2. Tell users to allow only the exact hosts required for their deployment. 3. Provide provider-specific instructions for local scripts rather than assuming wildcard or localhost settings are appropriate. 4. Document that a `403 Invalid Host` response should be resolved by correcting the expected host configuration, credential type, or deployment setup. 5. Recommend separate credentials for development and production. 6. Apply narrow quotas, rotation policies, monitoring, and revocation procedures to the API credential. 7. Emphasize that host restrictions are defense in depth and do not replace secure secret storage. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is weather retrieval, but the documented behavior also includes reading workspace secrets from TOOLS.md and sending outbound email. This mismatch is security-relevant because users and policy engines may approve the skill expecting simple API lookups, while the actual behavior expands into credential handling and exfiltration-capable delivery channels.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises network access and implicit file-reading behavior through its instructions, but it does not declare an explicit permission or allowed-tools scope. In an agent environment, missing scope declarations can cause overbroad execution authority and reduce reviewability, making it easier for the skill to access local files such as TOOLS.md and perform outbound requests without clear user visibility.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The description and title present the skill as explicitly Chinese-language and China-specific, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale policy violation unless clearly justified as region-specific compliance tooling, which is not stated here.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The document claims secrets in TOOLS.md are encrypted, but the example instructions show plain-text storage of API keys and email authorization codes. This creates a false sense of security that may lead users to store highly sensitive credentials unprotected in the workspace, where they can be read by local tools, other skills, or accidental disclosure mechanisms.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script reads SMTP credentials from TOOLS.md even though the stated purpose is weather retrieval, expanding its privilege scope beyond what users would expect. Access to email credentials enables outbound messaging and potential misuse of a sensitive account if the skill is invoked in an untrusted context.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script silently loads sensitive credentials from TOOLS.md with no meaningful runtime disclosure or consent flow. In an agent setting, hidden access to local secrets is dangerous because users may not realize the skill consumes and later uses credentials for external actions.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""Open-Meteo API（免费，无需 Key）"""
    
    def get_weather(self, city):
        url = "https://api.open-meteo.com/v1/forecast"
        params = {
            "latitude": city["lat"],
            "longitude": city["lon"],

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill is described as fetching weather data, but it also sends email, which is a materially broader capability involving outbound communication to third parties. This increases risk because a user or platform may grant or trust the skill for data retrieval while it can also exfiltrate content through email, especially given the default recipient behavior.

Intent-Code Divergence

Low

• Confidence: 76% confidence
• Finding: The documentation presents TOOLS.md handling as a secure automatic-loading mechanism and later repeats that sensitive info is 'encrypted' there, but the only concrete mechanism shown is storing secrets in a local markdown file. This creates a misleading security narrative about how secrets are actually handled, which could cause users to overtrust the setup.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: The documentation claims sensitive configuration comes from TOOLS.md, yet the code hardcodes a default recipient address. This creates undisclosed outbound data flow to a fixed third party, which is risky because generated reports may be emailed automatically even when the user did not specify a recipient.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The script sends city latitude/longitude to the Open-Meteo service to retrieve forecasts. While this is functionally expected for a weather script, the code provides no explicit disclosure that location data is sent to external services.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The script makes external requests to QWeather using a sensitive API key and city identifiers, but does not clearly disclose this outbound transmission to the user. Visible disclosure is recommended for network operations involving credentials or system configuration.

Static analysis

No suspicious patterns detected.