Weather

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:31 AM UTC
• Version: 0.1.0

Overview

This is a small weather helper whose network calls are expected for its purpose, but its examples should use HTTPS and safer temporary files.

Install only if you are comfortable with weather locations or coordinates being sent to wttr.in or Open-Meteo. Prefer changing the wttr.in examples to explicit https:// URLs with curl failure handling, and use mktemp or a private directory instead of /tmp/weather.png for image downloads.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16

Finding

Weather requests are transmitted over insecure HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16, 22, 28, and 38
Vulnerability Type: Plaintext HTTP communication
Risk Level: Medium

Vulnerable Code

bash

curl -s "wttr.in/London?format=3"

bash

curl -s "wttr.in/London?format=%l:+%c+%t+%h+%w"

bash

curl -s "wttr.in/London?T"

bash

curl -s "wttr.in/Berlin.png" -o /tmp/weather.png

Technical Analysis

The URLs omit an explicit scheme. curl ordinarily interprets such URLs as HTTP, causing the initial request to be sent without transport encryption. A subsequent HTTPS redirect does not protect that initial request.

An attacker with a position on the network path could observe requested locations, alter the response, or return a forged HTTP response without permitting the request to reach the legitimate service. Because the downloaded weather data may be processed or presented by an agent, manipulated content can also compromise the integrity of downstream decisions. The commands do not enable curl failure handling, so HTTP errors can be mistaken for valid weather responses.

Attack Path

1. The agent executes one of the documented curl commands.
2. curl initiates a plaintext HTTP request to wttr.in.
3. A network-positioned attacker intercepts the request before any HTTPS redirect.
4. The attacker learns the requested location or returns a forged weather response or image.
5. The agent accepts, stores, or presents the attacker-controlled response as weather data.

Impact Assessment

Exploitation does not directly grant operating-system privileges. It compromises the confidentiality of queried locations and the integrity of returned weather information. For the image-download example, an attacker can control the bytes written to the designated output file. The scope is limited to requests made through the affected commands and any downstream use of their responses.

Remediation

View remediation

Remediation Suggestions

Use explicit HTTPS URLs for every request and enable reliable error handling:

bash

curl --fail --show-error --silent \
  "https://wttr.in/London?format=3"

Apply the same change to all other wttr.in examples. If redirects are required, use --location together with HTTPS and restrict permitted protocols:

bash

curl --fail --show-error --silent --location \
  --proto '=https' --proto-redir '=https' \
  "https://wttr.in/London?T"

Treat remote responses as untrusted data, validate expected content types and formats before downstream processing, and avoid presenting error pages as valid weather results.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:38

Finding

Predictable shared temporary-file path permits symlink-based overwrite

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 38
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Low

Vulnerable Code

bash

curl -s "wttr.in/Berlin.png" -o /tmp/weather.png

Technical Analysis

The command writes downloaded data to a fixed, predictable path in the shared /tmp directory. If another local user can create /tmp/weather.png before the command runs, that user may create a symbolic link pointing to another file.

When curl opens the predictable output path, it can follow the symbolic link and truncate or overwrite the linked destination, provided the account running the agent has permission to write to that destination. Repeated invocations can also unintentionally overwrite a legitimate file left by an earlier invocation.

Attack Path

1. A local attacker predicts that the agent will use /tmp/weather.png.
2. Before invocation, the attacker creates /tmp/weather.png as a symbolic link to a target file.
3. The agent executes the documented curl command.
4. curl follows the symbolic link when opening the output path.
5. Remote response bytes overwrite or corrupt the target file if the agent has write permission to it.

This path requires local access to the shared temporary directory, the ability to prepare the path before execution, and a target writable by the agent account.

Impact Assessment

The operation runs with the existing privileges of the agent and does not independently provide privilege escalation. Successful exploitation can overwrite or corrupt files writable by that account. The practical scope depends on the agent's filesystem permissions and whether the operating system's temporary-directory protections prevent the specific symlink operation.

Remediation

View remediation

Remediation Suggestions

Create a unique temporary file atomically with mktemp, apply restrictive permissions, use HTTPS, and remove the file when it is no longer needed:

bash

umask 077
weather_file="$(mktemp "${TMPDIR:-/tmp}/weather.XXXXXX.png")" || exit 1
trap 'rm -f -- "$weather_file"' EXIT

curl --fail --show-error --silent \
  --proto '=https' \
  "https://wttr.in/Berlin.png" \
  --output "$weather_file"

Where possible, store the output in a private application-owned directory rather than a shared temporary directory. Do not reuse a fixed filename supplied through an untrusted or world-writable location.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

Free, no key, good for programmatic use:

bash

curl -s "https://api.open-meteo.com/v1/forecast?latitude=51.5&longitude=-0.12&current_weather=true"

Find coordinates for a city, then query. Returns JSON with temp, windspeed, weathercode.

Static analysis

No suspicious patterns detected.