ClawHub
Back to skill

Security audit

weather-report-skills

Security checks for vulnerabilities and agentic risk

Overview

This Chinese weather-report skill is mostly a template plus a disclosed public weather fetch, with no hidden persistence, credential use, or destructive behavior found.

Install only if you are comfortable with the agent making an outbound request to wttr.in for weather data and producing Chinese-formatted reports with a fixed tone. Prefer reviewing or modifying the template if you need another locale, style, location handling, or a safer weather-data integration.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The reference includes a concrete curl | python3 pattern that fetches remote content and immediately parses it in an execution chain. Even though the current endpoint looks like a weather service, embedding this pattern in a skill encourages unsafe execution behavior, enables unreviewed outbound network access, and normalizes a high-risk construct that can become dangerous if the URL, parameters, or downstream handling change.

Content

Scanner excerpt · references/weather_template.md (reported line 175)May include surrounding context.

温度数据获取

bash
curl -s "wttr.in/Tianjin?format=j1" | python3 -c "
import json, sys
d = json.load(sys.stdin)
w = d['weather'][0]  # 0=今天, 1=明天, 2=后天

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest and description frame this as a weather-formatting skill, but the body instructs retrieval of live weather data from an external service. That mismatch can mislead operators and policy systems about the skill’s real behavior, causing it to be approved or invoked in contexts that do not permit external data access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

L003 写明“当用户询问天气、查看天气预报、或需要生成天气报告时触发”，其中“询问天气”“生成天气报告”范围很宽，未限定具体触发短语、上下文或排除条件。对于 markdown 技能说明，这种描述容易覆盖常见日常表达，增加非预期调用风险。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is presented as a formatting/template skill but instructs the agent to execute an external shell command (curl) to fetch live data. This expands the skill’s capabilities from passive formatting to network access and command execution, which increases attack surface, bypasses least-privilege expectations, and can enable SSRF-like or policy-violating outbound requests if adapted or reused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

L023 的固定开场白“主人好呀~，青芜为您带来...”强制采用中文且带特定人设语气，但文档未说明这是用户自选语言/语气，也未提供语言或风格切换选项。根据自然语言政策要求，未经用户选择即固定语言/locale 或表达风格可能构成策略违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This markdown template is entirely written as Chinese-only output guidance, beginning with a Chinese title and continuing with fixed Chinese phrasing for generated weather reports. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the region-specific constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file is described as a weather formatting reference, but it embeds operational instructions to fetch live data over the network and process it with a shell pipeline. In an agent-skill context, including executable retrieval steps expands the skill from presentation logic into data acquisition, which can trigger unintended outbound requests, reduce determinism, and create an injection/supply-chain surface if such snippets are copied into execution paths.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.