Historical Weather - 历史天气

• Outcome: Pass
• Latest audit: May 29, 2026, 8:19 PM
• Version:
  1.0.5

Overview

This skill is a narrow historical-weather lookup that uses a declared JisuAPI key to call the disclosed weather service.

Install this if you are comfortable providing a JisuAPI app key and sending city/date weather queries to JisuAPI. Use a dedicated key with quota limits, and ensure the Python requests package comes from a trusted environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 75% confidence
• Finding: The trigger language is broad enough that the skill could be auto-invoked for loosely related weather requests, causing overbroad routing and unnecessary external API calls. While not a direct code-execution issue, this can expose user queries to a third-party service when the user did not clearly intend to use this specific integration.

VirusTotal

38/38 vendors flagged this skill as clean.