Security audit
Security checks for vulnerabilities and agentic risk
This weather skill is a simple documented wrapper for a remote weather API, with expected location sharing and no local persistence or hidden execution.
Before installing, understand that weather queries, including precise coordinates if you provide them, are sent to weather.agentutil.net. Use city or region names instead of exact coordinates when you do not need precision.
The skill documentation instructs users to send location names or precise coordinates to a third-party weather service without clearly warning that this data leaves the local environment. Location data can be sensitive, especially when exact coordinates are used, so the omission creates a real privacy and transparency issue even if the service claims limited data collection.
The skill performs an outbound POST request to an external service and includes user-supplied location information in the request body. External transmission is expected for a weather skill, but it still represents a genuine data exposure risk because sensitive location inputs are sent to a remote operator outside the user's direct control.
curl -X POST https://weather.agentutil.net/v1/current \
-H "Content-Type: application/json" \
-d '{"location": "London"}'
No suspicious patterns detected.