Weather Intelligence Digest Fresh

• Analyzed: May 12, 2026, 4:20 AM
• Findings: 1
• Version: 1.0.0
• Hash: 7c9ea8d004b02f6d95bca7b71f56ad8693e93f6c15193a0ba7c58337b638a6f1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's core functionality is benign, fetching weather data from api.weather.gov. However, it is classified as suspicious due to vulnerabilities related to arbitrary file read/write and potential output injection. The `weather_digest.py` script accepts `--config`, `--output`, `--html`, and `--json` arguments, which could allow an attacker to read or write to arbitrary file paths if an AI agent were to execute the skill with untrusted input. Additionally, user-controlled input from `config.json` (e.g., location `name`) and external API data (alert headlines/instructions) are embedded into the generated Markdown and HTML without sufficient sanitization, posing a risk for XSS or Markdown injection if the input or API response were malicious.