Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward weather-query skill that discloses its public weather data sources and does not include executable code, persistence, credentials, or privileged local access.
Install if you want a Chinese-language weather helper that queries public weather APIs. Be aware that location queries may be sent to wttr.in or Open-Meteo, and the skill does not clearly define non-weather activation boundaries or multilingual behavior.
The skill description is broadly framed around common weather questions, which can overlap with ordinary conversation and cause unintended activation. In an agent environment, overbroad triggering can route unrelated user input into this skill, leading to incorrect tool use, privacy leakage in downstream requests, or degraded assistant behavior.
整个技能文档均以中文描述输入输出示例和行为预期，但未说明是否支持其他语言，也未向用户提供语言/locale 选择。这可能构成语言/地区策略上的默认强制约束，特别是该技能宣称支持“全球城市天气信息”。
The example utterances are very generic everyday phrases like asking how the weather is or how many degrees it is, without clear activation constraints. This increases the chance of false positives and accidental invocation, especially in multilingual or context-rich chats where similar phrases may appear incidentally.
This manifest file gives a broad natural-language description of the skill's capabilities but does not specify what phrases or conditions should activate it. Without explicit trigger scope or exclusion conditions, invocation logic may be inferred too broadly from common weather-related requests.
No suspicious patterns detected.
