Historical Weather - 历史天气

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:04 AM UTC
• Version: 1.0.5

Overview

This skill is a straightforward historical weather lookup tool that sends city/date queries to the documented JisuAPI service using a user-provided API key.

Before installing, make sure you are comfortable sending the queried city/date and your JISU_API_KEY to JisuAPI over HTTPS. Keep the API key scoped to this provider and rotate it if it is exposed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares access to an environment variable containing an API key and necessarily performs outbound network requests, but it does not define an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: a host or agent may permit broader execution than intended, making secret access and external communication less constrained and harder to audit.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The description specifies trigger examples and usage entirely in Chinese, which indicates the skill is intended to operate in a single language. There is no note offering language choice or stating that Chinese is optional, so this is a natural-language locale policy concern.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests


BASE_URL = "https://api.jisuapi.com/weather2"


def _call_api(path: str, appkey: str, params: dict = None):

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill sends request parameters, including user-provided city/date values and the API key, to a third-party weather service via HTTP. While the module docstring names the API provider, there is no explicit user-facing warning, confirmation, or runtime disclosure that input data will be transmitted off-system.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The only natural-language description in the file is entirely in Chinese, which can constitute a locale/language policy issue when no user opt-in or justification is provided. Nothing in the file indicates the skill is intentionally limited to Chinese-speaking users or a China-specific deployment context.

Static analysis

No suspicious patterns detected.