Security audit
Security checks for vulnerabilities and agentic risk
This skill builds a summer and Beijing sunrise dashboard with disclosed external data fetches and no hidden persistence or credential access.
Install only if you are comfortable with generated widgets contacting public time/sunrise APIs when opened. Users outside Beijing should know the sunrise panel is intentionally Beijing-specific, not local.
The trigger description is overly broad and could cause the skill to activate for general time, season, or location-related queries beyond the user's actual intent. This can route users into a widget that makes external requests and presents locale-specific information unnecessarily, increasing the chance of unintended data flow and user confusion.
The skill is hardwired to China/Beijing sunrise data without requiring user opt-in or confirming that this locale is desired. This can lead to misleading output for users in other regions and unexpected external requests tied to a location the user did not choose.
The skill performs a runtime fetch to a third-party sunrise-sunset API, which creates an external network dependency and transmits request metadata such as IP address, user agent, and access timing to an outside service. While the coordinates are static and not user-derived, unintended invocation of the skill makes this disclosure more concerning because users may not expect a third-party request.
Fetch from the sunrise-sunset API at runtime using the Beijing coordinates:
- Latitude: 39.9075
- Longitude: 116.3972
- API endpoint: `https://api.sunrise-sunset.org/json?lat=39.9075&lng=116.3972&formatted=0&date=today`
- Note: the API returns UTC times, convert to CST (UTC+8)
- Display: sunrise time, sunset time, solar noon, day length
The example code issues a client-side fetch directly to a third-party API, exposing the user's browser/network metadata to that service and making the widget dependent on an untrusted external endpoint. In context, this is somewhat mitigated by the use of fixed Beijing coordinates rather than user-supplied data, but it still creates an avoidable external transmission channel.
const SUMMER = new Date('2026-06-21T01:24:30'); // local time interpretation
async function fetchSunrise() {
const r = await fetch('https://api.sunrise-sunset.org/json?lat=39.9042&lng=116.4074&formatted=0');
const d = await r.json();
// results.sunrise and results.sunset are ISO strings in UTC
// Add 8 hours for CST
No suspicious patterns detected.