T08 · Insecure Dependencies
Warning
- Location
SKILL.md:60- Finding
Mutable Git Installation and Unpinned Build Backend Permit Supply-Chain Code Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Yr Weather
Security checks for vulnerabilities and agentic risk
Overview
The skill's weather lookup behavior is mostly coherent, but its documentation recommends an unpinned Git-based pip install that can run mutable external code.
Review this before installing. The local skill code is a simple MET Norway weather client, but avoid the documented unpinned Git install unless you trust that repository and build chain; prefer a reviewed commit hash or verified release artifact. Also be aware that latitude, longitude, and optional altitude are sent to MET Norway when fetching forecasts.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)
YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]
High
- Category
- YARA Match
- Confidence
- 94% confidence
- Finding
The documentation instructs installation directly from a remote Git repository via pip, which introduces a software supply-chain risk. If the referenced repository, tag, dependency chain, or transport context is compromised, users may fetch and run unreviewed code; in a skill context, normalizing remote bootstrap commands makes this pattern more dangerous.
- Content
35.6762 | 139.6503 |
Structure
text scripts/ ├── yr_service.py # API calls (tested/mocked) ├── utils.py # Emoji/symbol helpers ├── weather.py # Current + forecast CLI ├── tomorrow.py # Tomorrow summary CLI └── tests/data/ # Sample JSON tests/ ├── test_weather.py └── test_service.pyStandalone Repo
Install via pip:
pip install git+https://github.com/brandoncrabpi/yr-weather.gityr-weather -33.9288 18.4174- Tagged: v1.0.0
Usage Terms
- User-Agent required (included).
- Cache 10min+ per location.
- Credit: "Data from MET Norway".
Refactored for production: no defaults, tests, modular service.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises and instructs use of network-capable scripts but does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, this can lead to undeclared outbound requests being available to the skill, reducing transparency and making policy enforcement harder.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest says to use the skill when the user asks for "weather information, forecasts, temperature, precipitation, wind conditions, or any weather-related queries for specific locations." This is a very broad activation description without explicit exclusions or narrower trigger boundaries, which could cause unintended invocation on common conversation about weather.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file-level and function documentation say this script provides tomorrow's weather output, but the range calculation iterates over
tomorrow_entriesas if each item already contained atempfield. Earlier code showstomorrow_entriescontains raw API entries and temperature is nested underentry['data']['instant']['details'], so this line will fail instead of formatting the advertised forecast output.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python mock_response.__enter__.return_value = mock_response # Fix context manager data = get_location_forecast(-33.9288, 18.4174) expected_url = "https://api.met.no/weatherapi/locationforecast/2.0/compact?lat=-33.9288&lon=18.4174" self.assertIn(expected_url, mock_urlopen.call_args[0][0].get_full_url()) @unittest.mock.patch('urllib.request.urlopen')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python mock_response.__enter__.return_value = mock_response # Fix context manager data = get_location_forecast(-33.9288, 18.4174) expected_url = "https://api.met.no/weatherapi/locationforecast/2.0/compact?lat=-33.9288&lon=18.4174" self.assertIn(expected_url, mock_urlopen.call_args[0][0].get_full_url()) @unittest.mock.patch('urllib.request.urlopen')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python mock_response.__enter__.return_value = mock_response # Fix context manager data = get_location_forecast(-33.9288, 18.4174) expected_url = "https://api.met.no/weatherapi/locationforecast/2.0/compact?lat=-33.9288&lon=18.4174" self.assertIn(expected_url, mock_urlopen.call_args[0][0].get_full_url()) @unittest.mock.patch('urllib.request.urlopen')
Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This Python code file makes a network call via get_location_forecast(args.lat, args.lon), which likely transmits the user-provided location to an external service. While the module docstring and CLI description say the tool gets weather from Yr.no, there is no explicit runtime disclosure, confirmation, or warning that coordinates will be sent to a remote service.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This CLI sends user-supplied latitude/longitude to an external weather service without any explicit user-facing disclosure in this file. While expected for a weather skill, location data can still be privacy-sensitive, so the lack of notice is a real but low-severity privacy issue rather than a code-execution or system-compromise flaw.
- Content
Static analysis
No suspicious patterns detected.