ClawHub
Back to skill

Security audit

Tübingen Weather

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Tübingen weather skill, with the main caution that its optional cron setup will keep running and messaging automatically until the user removes it.

Install only if you want a German Tübingen weather report. If you enable the cron example, remember it creates a recurring task that will continue making daily network requests, writing reports under data/weather, and forwarding summaries until you remove that cron entry.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T06 · System Persistence

Warning
Location
SKILL.md:24
Finding

Persistent Daily Agent Execution Through Cron Registration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-38
Vulnerability Type: Persistent scheduled task registration
Risk Level: Medium

Vulnerable Code

bash
openclaw cron add <<'JSON'
{
  "name": "tuebingen-weather-08",
  "schedule": { "kind": "cron", "expr": "0 8 * * *", "tz": "Europe/Berlin" },
  "sessionTarget": "isolated",
  "payload": {
    "kind": "agentTurn",
    "model": "default",
    "message": "Run `python3 skills/tuebingen-weather/scripts/fetch_tuebingen_weather.py --output data/weather/$(date +%F)_tuebingen.txt`. Send Master the stdout summary + mention the saved file. Report errors if the command fails."
  }
}
JSON

Technical Analysis

The documented setup registers a persistent OpenClaw cron entry that survives the initial skill invocation. At 08:00 each day, the scheduler creates an isolated agent turn and instructs it to execute a Python command, write output to local storage, and forward the resulting summary.

Although the scheduled operation is consistent with the weather-reporting purpose and the reviewed Python script contains no malicious payload, installing a recurring agent task establishes cross-session execution. The instructions do not provide an explicit removal command, lifecycle controls, or a confirmation step immediately before persistence is created.

The scheduled payload uses a general agent turn rather than a narrowly constrained invocation. Its effective privileges are therefore those available to the scheduled OpenClaw agent and the operating-system account under which it runs.

Attack Path

  1. A user follows the automated-delivery instructions in SKILL.md.
  2. The user submits the supplied configuration to openclaw cron add.
  3. OpenClaw creates a persistent task named tuebingen-weather-08.
  4. At 08:00 each day, the scheduler starts an isolated agent turn.
  5. The agent executes fetch_tuebingen_weather.py, which make ...[truncated 942 chars]
Remediation
View remediation

Remediation Suggestions

  1. Make scheduled installation explicitly opt-in and request confirmation immediately before running openclaw cron add.
  2. Clearly disclose that the task persists across sessions and runs automatically every day.
  3. Document exact commands for listing, disabling, and deleting the tuebingen-weather-08 cron entry.
  4. Prefer a narrowly scoped scheduler action that invokes only the fixed script rather than creating a general-purpose agent turn.
  5. Run the task under a dedicated least-privilege account with write access limited to the intended weather-output directory.
  6. Restrict outbound network access to the required Open-Meteo HTTPS endpoint and the explicitly approved messaging destination.
  7. Pin the script path to a trusted, non-user-writable location and verify file ownership and permissions before each execution.
  8. Add retention or cleanup controls so daily report files cannot accumulate indefinitely.
  9. Record task creation and each scheduled execution in an auditable log, and notify the user when scheduling is enabled or changed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The metadata promises automated 08:00 delivery, local storage, and Telegram forwarding, but the documented implementation only provides a manual script plus separate instructions to create a cron job. This mismatch is dangerous because users may rely on capabilities or integrations that are not actually implemented or audited, leading to unsafe deployment assumptions and hidden operational gaps.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill invokes a networked Python script and supports writing output to local files, but the manifest does not declare any tool scope or permissions. This creates a trust and review gap: an agent or operator may approve the skill without realizing it can access the network and modify local storage, increasing the chance of unintended data access or persistence.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README text states that output is a German weather summary, which imposes a specific language/locale behavior. The file does not indicate that users can choose another language or explicitly opt into German-only output, making this a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fetch_tuebingen_weather.py (reported line 15)May include surrounding context.

python
from urllib import request

API_URL = (
    "https://api.open-meteo.com/v1/forecast?latitude=48.5216&longitude=9.0576"
    "&current_weather=true"
    "&hourly=temperature_2m,precipitation_probability"
    "&daily=temperature_2m_max,temperature_2m_min,precipitation_probability_max"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script hard-codes German weather descriptions and German summary text such as "Tübingen Wetter" and "Hinweis". This imposes a specific language on all users without offering opt-in, selection, or a documented reason for the locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.