Weather Daily

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:18 AM UTC
• Version: 1.1.0

Overview

This is a weather briefing skill with disclosed memory-based profile storage and optional scheduled push notifications; no hidden data access, credential use, or destructive behavior was found.

Install only if you are comfortable with the agent saving your weather profile in MEMORY.md and, if you enable push notifications, creating persistent scheduled jobs that include your city, language, units, and timezone in their commands. Use the off command and delete the profile block from MEMORY.md to remove the stored configuration.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description overstates the skill's functionality. The code only validates CLI arguments and prints a formatted instruction asking another system to search for tomorrow's weather and produce an evening preview. It does include clothing/umbrella reminders and extreme weather alerts in the template, but only for the evening/tomorrow-preview use case. There is no implementation for morning conditions or a general daily briefing flow. The primary purpose is therefore narrower and materially different from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description emphasizes a daily briefing focused on today's morning conditions, what to wear, umbrella guidance, evening preview, and alerts. The code instead constructs a text prompt for a downstream model to perform web searches and return a 7-day forecast. While there is some overlap on weather, alerts, and clothing advice, the primary behavior is materially different in scope and output: weekly vs daily, prompt generation vs direct briefing, and lacking the specific morning/evening/umbrella elements claimed in the description. No undeclared sensitive permissions or resource access are evident, but the functionality is still mismatched.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill provides a daily weather briefing for any city, focused on same-day items like morning conditions, what to wear, umbrella forecast, evening preview, and alerts. The code instead is explicitly a 'monthly-push' script for month-end use that checks whether today is the last day of the month, then prints instructions for obtaining a next-month weather overview. Its output is a monthly report template with search steps, temperature/climate summaries, early/mid/late month trends, and lifestyle tips. It does not itself retrieve weather data, and it does not generate a daily briefing or day-specific morning/evening conditions. This is a material mismatch in primary purpose, behavior, and trigger cadence.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a user-facing weather briefing skill whose primary function is to provide daily weather information and alerts. This code chunk instead manages push scheduling infrastructure: turning scheduled pushes on/off, configuring times, channel, timezone, and emitting cron registration/removal commands. While it is weather-related, its actual purpose is operational task scheduling rather than generating or delivering the described briefing content itself. It also includes undeclared weekly and monthly scheduling capabilities and channel-routing behavior. Therefore the code chunk does not accurately match the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents the skill as an end-user weather briefing capability. However, the supplied code chunk is specifically a registration/setup utility. Its primary function is input sanitization and generation of a profile block for storage in MEMORY.md, along with suggested commands to enable push delivery and invoke other scripts. While weather-related configuration is supportive of a broader weather skill, this chunk does not itself perform the described weather briefing behavior. Because the actual code's primary purpose is materially different from the declared purpose, this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description says the skill provides a daily weather briefing with same-day elements like morning conditions and evening preview. The code instead builds a next-week forecast prompt labeled as a weekend weekly push, covering Monday through Sunday of the upcoming week. It does include some overlapping weather-advice elements such as what to wear, umbrella days, and alerts, and it appears to avoid API keys, but its primary purpose is materially different from the declared daily briefing. Therefore this is a clear description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

1. 新用户 → 运行 `register.js`，它会输出一段 `<!-- weather-daily:profile:<userId> -->` markdown 区块。**把该区块写入 MEMORY.md。**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

1. 新用户 → 运行 `register.js`，它会输出一段 `<!-- weather-daily:profile:<userId> -->` markdown 区块。**把该区块写入 MEMORY.md。**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

1. 新用户 → 运行 `register.js`，它会输出一段 `<!-- weather-daily:profile:<userId> -->` markdown 区块。**把该区块写入 MEMORY.md。**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

1. 新用户 → 运行 `register.js`，它会输出一段 `<!-- weather-daily:profile:<userId> -->` markdown 区块。**把该区块写入 MEMORY.md。**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md

1. 新用户 → 运行 `register.js`，它会输出一段 `<!-- weather-daily:profile:<userId> -->` markdown 区块。**把该区块写入 MEMORY.md。**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

node scripts/push-toggle.js on <userId> --city <城市> [--units metric|imperial] [--lang zh|en] \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

node scripts/push-toggle.js on <userId> --city <城市> [--units metric|imperial] [--lang zh|en] \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

node scripts/push-toggle.js on <userId> --city <城市> [--units metric|imperial] [--lang zh|en] \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md

node scripts/morning-push.js <userId> --city <城市> --units <metric|imperial> --lang <zh|en>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md

node scripts/forecast.js <userId> --city <城市> --units <..> --lang <..>

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation examples use very broad natural-language triggers such as common weather questions, increasing the chance of unintentional activation. In an agent environment, accidental routing to this skill can cause unexpected profile reads, scheduling flows, or disclosure of stored city/timezone preferences when the user only intended a generic chat response.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states that push mode bakes user data such as city, language, timezone, and schedule into cron commands, but it does not prominently warn users about the privacy and command-surface implications. Embedding user-controlled profile data into scheduled command lines can expose sensitive preferences in process listings, scheduler metadata, logs, or admin tooling, and increases risk if argument escaping is imperfect downstream.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill's name, description, and most tags are presented only in Chinese, with no indication that users can choose another language or locale. This creates a natural-language policy concern because the skill appears to enforce a specific language experience without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest declares a very broad set of generic weather-related keywords in both Chinese and English, including common phrases like 'weather', 'forecast', 'today weather', and 'AQI'. This can cause the skill to be invoked for a wide range of ordinary user requests, increasing the chance of unintentional interception, user confusion, or shadowing of more appropriate skills.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill provides a daily weather briefing with morning conditions, umbrella advice, evening preview, and alerts. This file instead runs at month end and produces instructions for a monthly overview of the next month's climate and weather patterns, which is a materially different behavior and timeframe.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script defaults the output language to Chinese if the city contains CJK characters and otherwise to English. This is a natural-language locale policy decision made without explicit user opt-in, which can violate language-choice requirements even though the header mentions language may be passed via CLI.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script’s natural-language interface and guidance are written entirely in Chinese, and the comments/instructions assume Chinese-language operation. It also defaults timezone and language behavior around Chinese context, which can impose a locale preference without explicitly offering user choice as a general policy matter.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a 'Daily weather briefing' covering morning conditions, umbrella advice, evening preview, and alerts. This script additionally provisions weekly and monthly scheduled reports for next-week and next-month weather, which are materially broader than a daily briefing and not mentioned in the skill description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script states that language is auto-detected from the city name if omitted, and later implements this by forcing zh for Chinese-character cities and en otherwise. This is a natural-language locale policy issue because it chooses a user-facing language without explicit user opt-in or offering a neutral default choice at runtime.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.