My Local Weather

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:30 AM UTC
• Version: 1.0.0

Overview

This is a simple weather lookup skill with some documentation and supply-chain hygiene issues, but no evidence of hidden persistence, credential theft, destructive behavior, or unrelated data access.

Before installing, be aware that weather queries send the location you ask about to wttr.in, and the current implementation only returns a basic current-weather response in Chinese despite broader English documentation. For better reproducibility, prefer a lockfile from an approved registry and exact dependency pinning.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: package-lock.json:16

Finding

Dependencies Are Locked to a Third-Party npm Mirror

Content

View full analysis

Vulnerability Details

File Location: package-lock.json, lines 16, 25, 48, 60, 80, and 98
Vulnerability Type: Third-party dependency source and software supply-chain risk
Risk Level: Low

Vulnerable Code

json

"resolved": "https://registry.npmmirror.com/data-uri-to-buffer/-/data-uri-to-buffer-4.0.1.tgz",
"resolved": "https://registry.npmmirror.com/fetch-blob/-/fetch-blob-3.2.0.tgz",
"resolved": "https://registry.npmmirror.com/formdata-polyfill/-/formdata-polyfill-4.0.10.tgz",
"resolved": "https://registry.npmmirror.com/node-domexception/-/node-domexception-1.0.0.tgz",
"resolved": "https://registry.npmmirror.com/node-fetch/-/node-fetch-3.3.2.tgz",
"resolved": "https://registry.npmmirror.com/web-streams-polyfill/-/web-streams-polyfill-3.3.3.tgz",

Technical Analysis

The lockfile directs package installation to registry.npmmirror.com, a third-party npm mirror, rather than the official registry.npmjs.org service. This expands the dependency trust boundary to include the mirror's infrastructure and operational security.

The lockfile contains integrity hashes, which cause npm to reject downloaded archives that do not match the pinned hashes. This substantially limits exploitation through mirror compromise alone. Nevertheless, risk remains if an attacker can also modify the lockfile, introduce a malicious archive and corresponding integrity value, or otherwise compromise the dependency publication and lockfile-generation process.

The application directly imports node-fetch, so malicious code introduced into that package or a transitive dependency could execute with the same operating-system privileges and environment access as the Skill process.

Attack Path

1. An attacker compromises the third-party mirror, the process used to generate the lockfile, or a contributor account capable of changing the lockfile.
2. A malicious dependency archive is hosted at one of the locked URLs.
3. Wher ...[truncated 1300 chars]

Remediation

View remediation

Remediation Suggestions

1. Configure npm to use the official registry:

   bash

   npm config set registry https://registry.npmjs.org/
   

2. Delete and regenerate the lockfile from a trusted environment:

   bash

   rm -rf node_modules package-lock.json
   npm install
   

3. Review the regenerated dependency graph and verify that all resolved entries use an approved registry.
4. Commit the reviewed lockfile and use npm ci in automated builds to prevent unreviewed dependency resolution.
5. Pin exact dependency versions where operationally appropriate and use automated vulnerability and integrity monitoring.
6. If a mirror is organizationally required, use an authenticated, controlled internal proxy with upstream validation, audit logs, access controls, and artifact integrity enforcement.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

## Configuration
This skill requires an API key for the weather provider (e.g., OpenWeatherMap, WeatherAPI).
1. Obtain an API key from your preferred provider.
2. Set the environment variable WEATHER_API_KEY or configure it in your .env file within the skill directory.
3. Optionally set WEATHER_UNITS to 'metric' or 'imperial'.

## Technical Details

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language content in comments, returned strings, and error messages is entirely in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy when a skill forces a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill sends the user-provided location to wttr.in, a third-party external service, without any visible disclosure, consent flow, or indication that user input leaves the local environment. Location data can be sensitive personal information, and exposing it to an external service creates a privacy risk, especially if users do not expect network transmission or if the service logs requests.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency version uses a caret range (^3.3.2), which allows automatic installation of newer compatible releases instead of a single fixed version. This increases supply-chain risk because a compromised or breaking upstream release could be pulled into future installs without explicit review, though the package here is a common HTTP client and the skill context does not make the issue unusually dangerous.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"openclaw"
                 ],
    "dependencies":  {
                         "node-fetch":  "^3.3.2"
                     }
}

Static analysis

No suspicious patterns detected.