Security audit
Security checks for vulnerabilities and agentic risk
This weather skill is purpose-aligned: it fetches user-requested forecast data from Open-Meteo and does not show hidden persistence, credential use, destructive behavior, or unrelated data access.
Before installing, understand that weather queries will send the requested coordinates and selected weather fields to Open-Meteo. Avoid using precise personal coordinates if you do not want that location shared with the weather API.
The skill instructs execution of a network-capable script (scripts/get_weather.py) but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where runtime policy may be overly permissive or inconsistent, increasing the risk of unintended outbound requests or future abuse if the script behavior changes.
The module docstring states the script fetches hourly temperature forecasts for a given location, implying a temperature-focused capability. In contrast, the implementation accepts any comma-separated hourly parameter string and sends it to Open-Meteo, enabling retrieval of non-temperature data too.
The manifest says the skill provides access to Open-Meteo for getting hourly temperature forecasts, but the code exposes a generic hourly_params input and forwards it directly to the API. This expands the behavior from temperature-only retrieval to arbitrary hourly weather data, which is broader than the stated scope.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
raise ValueError(f"Invalid longitude: {longitude}. Must be between -180 and 180")
# Build API URL
base_url = "https://api.open-meteo.com/v1/forecast"
params = {
"latitude": str(latitude),
"longitude": str(longitude),
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
raise ValueError(f"Invalid longitude: {longitude}. Must be between -180 and 180")
# Build API URL
base_url = "https://api.open-meteo.com/v1/forecast"
params = {
"latitude": str(latitude),
"longitude": str(longitude),
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
raise ValueError(f"Invalid longitude: {longitude}. Must be between -180 and 180")
# Build API URL
base_url = "https://api.open-meteo.com/v1/forecast"
params = {
"latitude": str(latitude),
"longitude": str(longitude),
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
raise ValueError(f"Invalid longitude: {longitude}. Must be between -180 and 180")
# Build API URL
base_url = "https://api.open-meteo.com/v1/forecast"
params = {
"latitude": str(latitude),
"longitude": str(longitude),
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
raise ValueError(f"Invalid longitude: {longitude}. Must be between -180 and 180")
# Build API URL
base_url = "https://api.open-meteo.com/v1/forecast"
params = {
"latitude": str(latitude),
"longitude": str(longitude),