Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward air-quality lookup that sends location queries to IQAir, with privacy considerations but no hidden or destructive behavior found.
Install only if you are comfortable sending queried locations, and sometimes IP-derived approximate location, to IQAir along with your IQAir API key. Prefer explicit city/country lookups over --nearest or exact latitude/longitude for privacy-sensitive use.
The skill requires environment access for IQAIR_API_KEY and network access to call the IQAir API, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates ambiguity about what capabilities the runtime may grant and weakens least-privilege enforcement, increasing the risk of overbroad tool access if the skill is invoked in a permissive environment.
The description instructs the agent to use this skill not only for air-quality questions but also for broad weather queries like 'How's the weather today?'. That broad trigger can cause unintended invocation, leading to unnecessary external API calls, exposure of user-provided locations to a third party, and confusion or contention with more appropriate weather-specific skills.
This endpoint transmits request data to an external third-party service, and in this specific case it may also reveal the user's approximate location via IP geolocation. The external transmission is expected for the feature, but it becomes security-relevant because the documentation does not frame the privacy implications or recommend consent/least-data practices.
Finds the nearest city based on IP geolocation:
curl "https://api.airvisual.com/v2/nearest_city?key=YOUR_API_KEY"
This endpoint sends precise latitude and longitude to an external third party, which can expose highly sensitive location data if coordinates come from the user or another tool. While necessary for the feature, the documentation does not mention consent, sensitivity of GPS coordinates, or data-minimization expectations.
Get air quality by GPS coordinates (most flexible):
curl "https://api.airvisual.com/v2/nearest_city?lat=56.9496&lon=24.1052&key=YOUR_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
sys.exit(1)
params["key"] = api_key
url = f"https://api.airvisual.com/v2/{endpoint}?{urllib.parse.urlencode(params)}"
try:
with urllib.request.urlopen(url) as response:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
sys.exit(1)
params["key"] = api_key
url = f"https://api.airvisual.com/v2/{endpoint}?{urllib.parse.urlencode(params)}"
try:
with urllib.request.urlopen(url) as response:
The documentation recommends using an IP-geolocation endpoint to determine the nearest city but does not warn that this sends the user's network-derived location to a third-party service. In a user-facing assistant skill, this can cause inadvertent disclosure of approximate location data, especially if the skill chooses the endpoint automatically for generic air-quality or weather queries.
No suspicious patterns detected.