Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward ski snow-report helper, with minor transparency issues around broad activation phrases and saved resort preferences.
Before installing, understand that the skill may open OpenSnow in a browser for resort-related snow questions and can save your home mountain and favorite resorts in memory/snow-preferences.md. Review or delete that file if you do not want those preferences retained.
The skill description includes broad triggers like 'snow', 'powder', and 'mountain weather', which can match ordinary conversation and cause over-invocation outside the user's intent. In a general assistant environment, this can unexpectedly route benign weather queries into a browser-driven third-party workflow, increasing privacy exposure and unintended external access.
The command list contains ambiguous phrases such as 'how's the snow' and 'where's it snowing' without limiting them to ski resorts or OpenSnow-supported lookups. That ambiguity raises the chance of unintended skill activation and background browsing based on conversational phrases that users may mean generically.
The skill instructs reading and creating a persistent preferences file for default mountain and favorites, but it does not tell the user that these preferences will be stored. Even though the data is relatively low sensitivity, silently persisting location-linked recreational preferences is a consent and transparency issue.
The first-time setup flow directs the agent to collect a home mountain and favorites, then persist them, but omits a user-facing disclosure or consent step. This makes background retention of personal preference data more likely and can surprise users who expected a one-time lookup.
No suspicious patterns detected.
