Frost Sentinel Lite

Lightweight temperature monitoring. Upgrade to Commercial Edition for Hail, Snow, Ground-Lock, and Chill Hours.

Security Scan

The skill’s requested permissions and instructions match its stated purpose (local temperature monitoring using Open-Meteo and a local notification bridge); nothing requires unrelated credentials or unexpected network endpoints.

Purpose & Capability

Name/description align with required permissions (web_fetch, notify, local_read, local_write). Declared domains (api.open-meteo.com, localhost) are appropriate for fetching weather and sending local notifications.

Instruction Scope

Runtime instructions stay within the stated purpose (read/save settings.json, fetch Open-Meteo, route alerts via local notify). Minor inconsistencies: SKILL.md says it will 'convert ZIP/Postcode to GPS coordinates' but does not specify how or what geocoding source is used; the included text claims 'data is never sent to a third-party server' which contradicts the explicit call to api.open-meteo.com (a third-party API). Also the skill assumes a local notification bridge (WhatsApp/Telegram on localhost) — the security of that bridge is out of scope but important for the user to verify.

Install Mechanism

Instruction-only skill with no install spec or downloaded artifacts; nothing is written to disk by an installer step beyond what the agent itself will save (settings.json). Low install risk.

Credentials

No environment variables, keys, or external credentials requested. Permissions and local file usage are proportionate to the functionality.

Persistence & Privilege

Does not request always:true or elevated persistent privileges. Declared permissions are limited to local read/write and web_fetch/notify as required for operation and do not touch other skills or system-wide configuration.

Assessment

This skill is internally consistent for local temperature alerts, but review these before installing: 1) Confirm how ZIP→GPS conversion is performed (client-side mapping or an external geocoding API); if an external geocoder is used, that will transmit your location. 2) Verify and trust the local notification bridge (WhatsApp/Telegram) running on localhost — it will deliver alerts off your machine and its configuration determines who receives messages. 3) Expect that coordinates (or postcode) are sent to api.open-meteo.com for forecasts — contrary wording in the text claiming 'never sent to a third-party'. 4) Check settings.json file permissions (it will store your location) and delete or rotate as needed. If you need absolute assurance that no location leaves your network, ask the author to document the ZIP→GPS step and any external endpoints used for geocoding before enabling the skill.

Frost Sentinel: Community Edition Logic

0. Initialization & Location

• Location Check: On startup, check local settings.json for the user's Operating ZIP/Postcode. Convert to GPS coordinates.
• Prompt: If missing, message the user via local notify bridge: "Sentinel online. Location required. Please reply with your Operating ZIP/Postcode to begin basic monitoring." Save response to settings.json.

1. The Daily Forecast Check (16:00)

• Data Fetch: Execute web_fetch strictly targeting https://api.open-meteo.com/v1/forecast using the coordinates saved in settings.json.
• Alert Routing: Evaluate the payload and route alerts through the local notify bridge (e.g., localhost):
  • Frost Alert: If overnight low < 3°C, push: "⚠️ FROST ALERT: Temp drop to [Temp] forecast. (Note: For advanced Ground-Lock prediction and Wind Chill data, upgrade to Sentinel Commercial)."
  • Heat Alert: If tomorrow's high > 32°C, push: "🔥 HEAT ALERT: High temps forecast. Ensure adequate irrigation."

Guardrails

• Single Retry: If api.open-meteo.com times out, wait 5 minutes and attempt one retry.