Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Croatian weather lookup helper with minor privacy and control caveats around inferred locations.
Install only if you are comfortable with the agent using a mentioned or inferred city for convenience when you invoke the skill. For privacy, provide the city explicitly, such as /dhmz-weather Zagreb, so the agent does not rely on conversation context.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
### Alerts
| Level | Emoji |
|-------|-------|
| Green (no warning) | 🟢 |
| Yellow | 🟡 |
| Orange | 🟠 |
| Red | 🔴 |
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Copy the SKILL.md file to your Claude Code skills directory:
# Create skills directory if it doesn't exist
mkdir -p ~/.claude/skills/dhmz-weather
# Copy the skill file
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
# Create skills directory if it doesn't exist
mkdir -p ~/.claude/skills/dhmz-weather
# Copy the skill file
cp SKILL.md ~/.claude/skills/dhmz-weather/
The skill explicitly instructs the agent to infer a city from conversation context, including the user's location, and to do so automatically without notice. This creates a privacy-sensitive behavior where location-derived data may be used or exposed without clear user consent, even though the downstream action is only a weather lookup.
The skill directs the agent to act autonomously and 'not ask the user,' including using inferred context to choose a city and immediately making network requests. While low-stakes in a weather skill, this reduces user control and can compound privacy issues by turning ambiguous context into action without confirmation.
1. **If a city is provided as argument** (e.g., `/dhmz-weather Zagreb`): Immediately fetch and display weather for that city
2. **If no city is provided**: Infer the city from conversation context (user's location, previously mentioned cities, or project context). If no context available, default to **Zagreb** (capital city)
**Do not ask the user what they want** - just fetch the weather data immediately and present it in a readable format.
## Weather Emojis
The file states that all data is in Croatian, which creates a language constraint in the skill behavior. There is no accompanying note that the skill can translate, summarize in the user's preferred language, or otherwise offer a language choice.
No suspicious patterns detected.