天气查询

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:30 AM UTC
• Version: 1.0.0

Overview

This skill is a simple weather lookup helper; its main risks are low-impact privacy and transport-security notes around querying wttr.in.

Install only if you are comfortable with weather queries being sent to wttr.in. Prefer updating the examples to use explicit https:// URLs and consider adding a note that results are intended to be returned in Chinese.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:15

Finding

Weather Queries Use Unencrypted HTTP Transport

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–23; repeated in example instructions at lines 36 and 39
Vulnerability Type: Explicit HTTPS is omitted from external weather-service URLs
Risk Level: Low

Vulnerable Code

bash

# Query Beijing weather
curl "wttr.in/Beijing?lang=zh"

# Query Shanghai weather in concise format
curl "wttr.in/Shanghai?format=3"

# Query a three-day forecast for a specified city
curl "wttr.in/Guangzhou?lang=zh"

The same insecure URL pattern is repeated in the example responses:

text

Run `curl "wttr.in/Beijing?lang=zh"` and report the result to the user.
Run `curl "wttr.in/Shanghai?lang=zh"` to inspect precipitation information in the forecast.

Technical Analysis

The documented URLs omit the https:// scheme. When curl receives a hostname in this form, it normally initiates the request over HTTP. Consequently, the initial request lacks transport encryption and server authentication.

Even if wttr.in subsequently redirects the client to HTTPS, the original HTTP request has already traversed the network in plaintext. An attacker capable of intercepting network traffic could observe the requested city, block or alter a redirect, or return a forged weather response before a secure connection is established.

The response is only displayed as weather information; the skill does not instruct the agent to execute it. Therefore, this issue does not constitute remote payload execution, and its expected effect is limited to confidentiality and integrity of weather queries.

Attack Path

1. A user asks the agent for weather information.
2. The agent follows SKILL.md and runs a curl command without an explicit HTTPS scheme.
3. An attacker on the local network, compromised gateway, or other relevant network path intercepts the plaintext HTTP request.
4. The attacker learns the requested city or supplies a forged HTTP response instead of allo ...[truncated 578 chars]

Remediation

View remediation

Remediation Suggestions

Replace every scheme-less URL with an explicit HTTPS URL, including commands in both the usage and example sections:

bash

curl --fail --silent --show-error "https://wttr.in/Beijing?lang=zh"
curl --fail --silent --show-error "https://wttr.in/Shanghai?format=3"
curl --fail --silent --show-error "https://wttr.in/Guangzhou?lang=zh"

Retain curl's default TLS certificate verification and do not introduce options such as --insecure. If redirects are required, permit them only from an initial HTTPS URL and consider constraining redirects to HTTPS. Handle failed requests as errors rather than presenting incomplete or unauthenticated content as valid weather data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description and examples consistently prescribe Chinese-language output, including explicit use of lang=zh, but do not indicate that this is optional or limited to a justified region-specific context. This is a natural-language locale policy issue because the skill fixes one language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to send user-supplied city queries to the third-party service wttr.in via curl, but it does not disclose that user request data will leave the local environment. Even if the data seems low sensitivity, queries may reveal user location, travel plans, or other contextual information, and the lack of transparency prevents informed user consent.

Content

No source excerpt is available for this finding.