Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent soaring-weather helper that fetches forecast data and computes thermal scores, with normal caveats about external weather APIs and localized aviation guidance.
Before installing, understand that the skill contacts external weather services with the selected location or coordinates and returns German/Central-European soaring guidance. It should be used as a planning aid, not as a replacement for official aviation weather briefings, local regulations, or pilot judgment.
If the code uses multiple models, diagnostics, or a hardcoded location while claiming a general-purpose ICON-D2 soaring forecast, the skill is materially misrepresented. In a flight-weather skill, inaccurate or developer-oriented output can mislead pilots into unsafe decisions, making the context more dangerous than a normal content mismatch.
If the code uses multiple models, diagnostics, or a hardcoded location while claiming a general-purpose ICON-D2 soaring forecast, the skill is materially misrepresented. In a flight-weather skill, inaccurate or developer-oriented output can mislead pilots into unsafe decisions, making the context more dangerous than a normal content mismatch.
The skill invokes a Python script that fetches forecast data, which implies network access, but the manifest does not declare any tool scope or allowed-tools restriction. Undeclared capability expansion is dangerous because it hides what the skill can access and prevents least-privilege enforcement or informed review.
The invocation scope is overly broad and can trigger on generic weather or weekend flying questions, causing the skill to run outside its narrowly intended domain. Overbroad routing increases accidental data exposure, unnecessary external calls, and the chance that users receive specialized aviation advice when they only wanted general weather information.
The file's natural-language description and operating instructions are fully German-language, and there is no indication that the skill should only be used for German-speaking users or that the user can choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
for model in models:
print(f"\nPrüfe Modell: {model}")
url = f"https://api.open-meteo.com/v1/forecast?latitude=47.5&longitude=11.1&hourly={','.join(vars)}&models={model}&forecast_days=1"
try:
with urllib.request.urlopen(url) as response:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
for model in models:
print(f"\nPrüfe Modell: {model}")
url = f"https://api.open-meteo.com/v1/forecast?latitude=47.5&longitude=11.1&hourly={','.join(vars)}&models={model}&forecast_days=1"
try:
with urllib.request.urlopen(url) as response:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
for model in models:
print(f"\nPrüfe Modell: {model}")
url = f"https://api.open-meteo.com/v1/forecast?latitude=47.5&longitude=11.1&hourly={','.join(vars)}&models={model}&forecast_days=1"
try:
with urllib.request.urlopen(url) as response:
This markdown file uses German throughout for headings, descriptions, warnings, and parameter explanations. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
The request parameters force the timezone to "Europe/Berlin", and the file-level documentation is written only in German. Under the policy for natural-language violations, hard-coded locale behavior should either be user-selectable or clearly justified as region-specific; this file does not state such a constraint explicitly.
This function again fixes the timezone to "Europe/Berlin" for date-sensitive weather retrieval. Repeating the locale constraint in operational code reinforces a region-specific assumption that is not exposed as a choice or clearly justified in the file.
The module docstring presents usage and output behavior only in German, and the CLI help strings and user-facing messages throughout the file follow the same pattern. This imposes a specific language on users without opt-in, which matches the language/locale policy-violation category.
The module docstring and many user-facing warning strings are written exclusively in German, indicating the skill is designed to communicate in a specific language by default. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
No suspicious patterns detected.