Weather via OpenMeteo (via openmeteo-sh cli; advanced ver)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:18 PM UTC
• Version: 1.2.2

Overview

The skill’s weather-query behavior is coherent, but its README documents unpinned third-party install paths that can run with root privileges.

Review the install path before using this skill. Prefer a pinned, verified release of `openmeteo-sh`; avoid running `sudo make install` from an unreviewed default branch, and verify any APT signing-key fingerprint or package source before adding it to system trust. The weather-query instructions themselves appear purpose-aligned.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:48

Finding

Unpinned Third-Party Installation Can Execute Mutable Upstream Code with Elevated Privileges

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 48–70
Vulnerability Type: Supply-chain risk from unpinned third-party installation sources
Risk Level: Medium

Vulnerable Code

sh

brew tap lstpsche/tap
brew install openmeteo-sh

sh

# Import the signing key
curl -fsSL https://lstpsche.github.io/apt-repo/pubkey.gpg \
  | sudo gpg --dearmor -o /usr/share/keyrings/openmeteo-sh.gpg

# Add the repository
echo "deb [signed-by=/usr/share/keyrings/openmeteo-sh.gpg] https://lstpsche.github.io/apt-repo stable main" \
  | sudo tee /etc/apt/sources.list.d/openmeteo-sh.list

# Install
sudo apt update
sudo apt install openmeteo-sh

sh

git clone https://github.com/lstpsche/openmeteo-sh.git
cd openmeteo-sh
sudo make install

Technical Analysis

The documented installation methods trust mutable external repositories without pinning a reviewed release tag, commit hash, package version, checksum, or signature identity.

The source installation is particularly sensitive because it clones the upstream repository's current default branch and then invokes make install with sudo. A Makefile can execute arbitrary commands, so this grants mutable upstream content root-level execution during installation.

The APT procedure downloads a signing key from an externally controlled site and installs it into the system trust configuration without verifying its expected fingerprint through an independent channel. The package repository is hosted under the same upstream-controlled namespace. Consequently, compromise of that namespace could allow an attacker to replace both the repository content and the key presented to new users.

The Homebrew procedure similarly adds and installs from a mutable third-party tap without version or artifact-integrity pinning. These practices create a dependency supply-chain exposure beyond the minimum runtime privileges needed to query weather data.

Attack Path

1. An attacker compromises the upstream Git ...[truncated 1440 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin source installations to a reviewed, immutable release tag and full commit hash instead of cloning and executing the current default branch.
2. Publish SHA-256 checksums for release archives and package artifacts, and require users to verify them before installation.
3. Cryptographically sign releases and document a trusted, independently verifiable signing identity.
4. Publish the expected APT signing-key fingerprint and require fingerprint verification before placing the key in the system keyring.
5. Avoid obtaining the APT repository and its initial trust anchor exclusively from the same administrative namespace where practical.
6. Pin package versions in installation examples and document a controlled update process.
7. Replace sudo make install on an unverified checkout with installation from a verified release artifact. Where possible, build without privileges and elevate only for the narrowly scoped file-copy step.
8. Document the files, commands, and privileges used by installation so users can review the privileged changes.
9. Consider sandboxing or packaging the CLI so its installation and runtime permissions are limited to those necessary for HTTPS weather queries.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

sh

# Import the signing key
curl -fsSL https://lstpsche.github.io/apt-repo/pubkey.gpg \
  | sudo gpg --dearmor -o /usr/share/keyrings/openmeteo-sh.gpg

# Add the repository
echo "deb [signed-by=/usr/share/keyrings/openmeteo-sh.gpg] https://lstpsche.github.io/apt-repo stable main" \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

sh

# Import the signing key
curl -fsSL https://lstpsche.github.io/apt-repo/pubkey.gpg \
  | sudo gpg --dearmor -o /usr/share/keyrings/openmeteo-sh.gpg

# Add the repository
echo "deb [signed-by=/usr/share/keyrings/openmeteo-sh.gpg] https://lstpsche.github.io/apt-repo stable main" \

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

This is a classic risky shell chain: remote content retrieved by curl is piped directly into a privileged command. Even though the stated purpose is to install a repository key, the pattern bypasses inspection and can amplify compromise of the remote source into root-level package trust establishment.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

sh

# Import the signing key
curl -fsSL https://lstpsche.github.io/apt-repo/pubkey.gpg \
  | sudo gpg --dearmor -o /usr/share/keyrings/openmeteo-sh.gpg

# Add the repository
echo "deb [signed-by=/usr/share/keyrings/openmeteo-sh.gpg] https://lstpsche.github.io/apt-repo stable main" \

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

md

# Add the repository
echo "deb [signed-by=/usr/share/keyrings/openmeteo-sh.gpg] https://lstpsche.github.io/apt-repo stable main" \
  | sudo tee /etc/apt/sources.list.d/openmeteo-sh.list

# Install
sudo apt update

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

md

- `bash` 3.2+ (pre-installed on macOS and Linux)
- `curl` (pre-installed on macOS and Linux)
- `jq` — install if missing: `brew install jq` (macOS) or `sudo apt install jq` (Debian/Ubuntu)

## Installation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

md

- `bash` 3.2+ (pre-installed on macOS and Linux)
- `curl` (pre-installed on macOS and Linux)
- `jq` — install if missing: `brew install jq` (macOS) or `sudo apt install jq` (Debian/Ubuntu)

## Installation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

This command pipes data fetched from the network directly into a privileged command that writes a trusted APT keyring file. Although common in setup docs, this creates a trust-on-first-use risk: if the source URL or transport were compromised, an attacker could install a signing key that authorizes malicious packages as root.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

sh

# Import the signing key
curl -fsSL https://lstpsche.github.io/apt-repo/pubkey.gpg \
  | sudo gpg --dearmor -o /usr/share/keyrings/openmeteo-sh.gpg

# Add the repository
echo "deb [signed-by=/usr/share/keyrings/openmeteo-sh.gpg] https://lstpsche.github.io/apt-repo stable main" \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

| sudo tee /etc/apt/sources.list.d/openmeteo-sh.list

Install

sudo apt update sudo apt install openmeteo-sh

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

| sudo tee /etc/apt/sources.list.d/openmeteo-sh.list

Install

sudo apt update sudo apt install openmeteo-sh

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

sudo make install executes installation logic from source code with root privileges, which can run arbitrary commands from the Makefile or invoked scripts. In a skill context, this is more dangerous because an agent or user may follow README steps without auditing the repository contents first.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

sh

git clone https://github.com/lstpsche/openmeteo-sh.git
cd openmeteo-sh
sudo make install

What the agent can do with this skill

Static analysis

No suspicious patterns detected.