get tomorrow weather of beijing , with Chinese almanac information

• Outcome: Pass
• Latest audit: May 28, 2026, 11:01 AM
• Version:
  1.0.2

Overview

This skill is a straightforward Beijing weather and almanac reminder with disclosed external lookups and Feishu delivery, though users should configure the schedule, recipient, and API credentials carefully.

Before installing, confirm the Feishu recipient openid, make sure the daily 18:00 schedule is visible and easy to remove, and store any mxnzp API secret securely rather than embedding it in shared skill text or shell history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The manual trigger phrases include very common utterances like '明天天气怎么样' and '天气推送', which can overlap with ordinary conversational weather requests. This can cause the skill to activate unexpectedly and send outbound messages or perform external lookups when the user only intended to ask a casual question, creating consent and privacy issues.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill description does not clearly warn that it will call external services and send a message to a Feishu recipient. Users may not realize their requests trigger network access and outbound messaging, which weakens informed consent and can lead to unintended disclosure of timing, usage, or recipient metadata.

VirusTotal

65/65 vendors flagged this skill as clean.