Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Yandex Weather helper that sends configured coordinates to Yandex to fetch weather, with no hidden persistence or unrelated access found.
Install only if you are comfortable storing your Yandex Weather API key and home coordinates in environment variables and sending those coordinates to Yandex when weather requests trigger the skill. Expect Russian output by default.
The skill mandates Russian output regardless of the user's language, even though the trigger examples include both Russian and English. This can override user intent and cause unsafe or misleading responses if the user cannot understand the result, especially when the skill auto-activates.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
1. Open Yandex Weather SmartHome page and go to personal cabinet registration.
2. Register with phone number and accept the user agreement.
3. After registration, copy API key from the personal cabinet.
4. Export the key as `YANDEX_WEATHER_KEY`.
Official page with FAQ and onboarding:
The skill declares it requires environment variables and uses an external weather API, but it does not define an explicit tool/permission scope. That omission can allow broader-than-necessary execution in agent frameworks and makes review/enforcement of network and secret access weaker.
The aliases include very generic terms like "weather", "погода", and "forecast", which can cause unintended activation in unrelated conversations. Misfiring a networked skill tied to home coordinates can unnecessarily disclose location-derived information or trigger external requests without clear user intent.
The activation rules use topic-based conditions such as temperature, wind, and forecast without defining when the skill should not run. In an agent environment, that ambiguity increases accidental invocation and can lead to unnecessary access to environment-backed home coordinates and external API calls.
Suspicious Unicode normalization or mixed-script content
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import argparse
from urllib import request, parse, error
API_URL = "https://api.weather.yandex.ru/v2/forecast"
CONDITION_RU = {
"clear": "ясно",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import argparse
from urllib import request, parse, error
API_URL = "https://api.weather.yandex.ru/v2/forecast"
CONDITION_RU = {
"clear": "ясно",
The request forces the weather API locale to ru_RU, and the script also renders condition labels and user-facing output in Russian. This is a natural-language locale constraint without any visible user opt-in or documented choice mechanism, which fits the policy-violation category for forced language/locale.