Weather via OpenMeteo (via openmeteo-sh cli; advanced ver)

• Analyzed: May 12, 2026, 3:56 AM
• Findings: 1
• Version: 1.2.2
• Hash: 9c4e57fdfdfd63f483da4d0c5a69f057e3a0c6303c6a47e708b3c3b35973ec98
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to query weather data using the `openmeteo` CLI. The `SKILL.md` explicitly instructs the AI agent to "Quote all user-provided values in shell commands" to prevent shell injection, demonstrating a clear intent to mitigate vulnerabilities. The `README.md` transparently declares network access to legitimate Open-Meteo API endpoints and lists common prerequisites (`bash`, `curl`, `jq`). There is no evidence of malicious intent such as data exfiltration to unauthorized endpoints, backdoors, or obfuscation. The installation methods for the `openmeteo-sh` CLI (Homebrew, APT, source) carry standard supply chain risks, but this is external to the skill bundle's runtime behavior and not indicative of malice within the skill itself.