Security audit
Security checks for vulnerabilities and agentic risk
This is a simple Chinese-language simulated weather lookup skill with no executable package, credentials, persistence, or hidden high-impact behavior.
Before installing, note that this skill returns hardcoded simulated weather data, not live forecasts, and its broad Chinese weather triggers may activate on ordinary weather questions.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
# 发布必备的元数据（YAML frontmatter）
name: simple-weather
slug: simple-weather # 唯一标识，小写+横杠，发布时用
The activation phrases are broad everyday weather terms like '天气', '下雨', and '今天天气怎么样', which can cause the skill to trigger on many ordinary conversations rather than only clear requests to use this specific capability. Overly broad activation increases the chance of unintended invocation, routing errors, and context leakage into the skill when the user did not explicitly intend to invoke it.
The skill instructions, trigger phrases, and usage description are entirely in Chinese, but the file does not state that the skill is intentionally limited to Chinese-speaking users or offer any language/locale opt-in. Under the stated policy, forcing a specific language without user choice or documented justification is a natural-language policy concern.
No suspicious patterns detected.