Security audit
Security checks for vulnerabilities and agentic risk
This is a small weather helper that contacts wttr.in for forecasts, with no evidence of hidden persistence, credential access, destructive behavior, or unrelated data collection.
Install only if you are comfortable with weather queries being sent to wttr.in, including IP-based location lookup when no location is provided. Use an explicit location if you do not want the service to infer location from the requesting IP.
The trigger list includes very broad terms like 'weather', 'forecast', 'temperature', 'rain', 'UV', 'humidity', and 'wind', which can cause the skill to activate in contexts the user did not intend. This increases the chance of accidental invocation and, in this skill's case, may unexpectedly send a query to an external weather service or trigger IP-based location lookup.
The documentation states that running the script with no location will auto-detect location by IP, but it does not prominently warn users that this sends location-related data to an external third-party service. This creates a privacy risk because users may unknowingly disclose IP-derived location information when invoking the skill with default behavior.
The usage example advertises '--lang=zh' while the script behavior also defaults to Chinese output, reinforcing a forced locale. There is no indication that users are offered a language choice by default or that the Chinese locale is a documented regional constraint.
The HTTP helper sets the default language to 'zh', and the CLI also defaults the language option to Chinese elsewhere in the file. This imposes a specific locale on users by default rather than offering a neutral default or explicit opt-in, which matches the language/locale policy violation criteria.
The script sends a user-provided location string to wttr.in, which is an external third-party service. While the location is URL-encoded and there is no injection issue here, this does create a real privacy concern because potentially sensitive user input is transmitted off-host without an explicit notice or consent mechanism.
No suspicious patterns detected.
