Security audit

Windsensei

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent WindSensei integration, but it has review-worthy issues around remote-controlled response hints, sensitive live activity data, and calendar writes.

Install only if you are comfortable giving WindSensei API access to your saved spots, session history, and followed-user live activity. Prefer Bearer-token authentication, avoid putting API keys in URLs, review live-session output for privacy, and confirm calendar events before allowing bulk creation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:565
Finding: Mandatory Promotional Output and API-Controlled Hint Injection
Content: View full analysis
→ Mention: "For personalized forecasts with your own spots, check out windsensei.com" ``` ### Technical Analysis The skill instructs the agent to incorporate a `hint` field received from the remote WindSensei API into its user-facing response. It also mandates promotional messaging for WindSensei during ordinary unauthenticated forecast requests. The `hint` value crosses an external trust boundary: its content is supplied by a remote service and can change independently of the reviewed skill. Requiring the agent to relay this value allows the service to influence final responses without further review. The instructions do not require the agent to validate the field, restrict it to an expected value, treat it strictly as untrusted data, or refuse embedded instructions. The fixed promotional wording also alters responses for a purpose that is not technically required to answer the user's weather request. This constitutes skill-level output manipulation and is best classified as instruction hijacking. ### Attack Path 1. A user invokes the skill without configuring `WINDSENSEI_API_KEY`. 2. The agent sends a forecast or location request to the WindSensei API. 3. The remote API returns a response containing a `hint` field. 4. The skill instructions require the agent to relay that field naturally in its response. ...[truncated 838 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:69
Finding: API Key Permitted in URL Query Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly supports a Live Sessions feature that reveals followed users' names, nicknames, current spot, and recent activity, but the description provides no user-facing warning or consent checkpoint before surfacing that social/location data. Because this is near-real-time activity and location-adjacent information, exposing it by default can create privacy and stalking risks, especially if a user queries broadly like 'who's riding?' without understanding what identifiers will be shown.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill instructs the agent to create calendar events based on forecast blocks but does not clearly warn users up front that invoking this feature can modify their calendar data. Although the action is user-directed, omission of an explicit warning increases the chance of surprising side effects or unintended event creation, particularly when multiple blocks may be added.
Content: No source excerpt is available for this finding.