skills-weather

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:39 AM UTC
• Version: 1.0.3

Overview

The weather skill's purpose is coherent, but its documentation exposes realistic authentication material and asks users to globally install unreviewed package code.

Review carefully before installing. Do not reuse the example credentials, do not commit your own QWeather private key to source control, prefer a protected local config or secret manager, and install only a pinned version from a trusted package source after reviewing the package contents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Global Installation of an Unreviewed Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-33
Vulnerability Type: Supply-chain exposure through an unpinned globally installed dependency
Risk Level: Medium

Vulnerable Code

markdown

npm

```bash
npm install -g skills-weather

pnpm

bash

pnpm add -g skills-weather

text

### Technical Analysis

The installation instructions retrieve the latest available release of `skills-weather` from a third-party package registry without pinning an exact version or verifying an integrity digest. The `-g` option installs the package globally, potentially exposing the resulting executable across the user's environment.

Package installation can execute lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Consequently, a compromised registry account, malicious future release, or supply-chain compromise could cause attacker-controlled code to execute during installation. The artifact does not include the declared `index.js` entry point, a lockfile, package metadata, or the dependency implementation, so the installed behavior cannot be verified against the reviewed content.

### Attack Path

1. An attacker compromises the upstream package, its publisher account, or its release process.
2. The attacker publishes a malicious version under the existing `skills-weather` package name.
3. A user follows the documented command without specifying an audited version.
4. The package manager resolves and downloads the malicious release.
5. Malicious lifecycle scripts may execute during installation, or malicious code runs when the globally installed command is invoked.
6. The payload operates with the privileges of the user performing the installation.

### Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on those privileges, the attacker could access user-readable files and credentials, modify use
...[truncated 214 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to a specific audited version, for example skills-weather@1.0.3, rather than implicitly installing the latest release.
• Verify the package with a trusted integrity digest or signed provenance before installation.
• Include the actual implementation, package manifest, and lockfile in the reviewed artifact so its behavior and dependency tree can be audited.
• Prefer a project-local installation over a global installation to reduce scope and avoid replacing globally available commands.
• Install with lifecycle scripts disabled where compatible, then explicitly review and run any required setup steps.
• Use a trusted registry and enable package-manager controls for provenance, vulnerability scanning, and lockfile enforcement.
• Perform installation under a non-privileged account and avoid sudo or administrator elevation.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:86

Finding

Realistic Private Authentication Material Embedded in Documentation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 86-93
Vulnerability Type: Hardcoded authentication credentials and identifiers
Risk Level: High

Vulnerable Code

json

{
  "privateKey": "G7refSYx9TWAPADGuOdyGycWVNr0POaebYddeNtDjxSSN01b0165TITV9fA=",
  "appId": "BB9A36BAB1",
  "credentialId": "3207A9092A",
  "apiHost": "0dfe03a7c3.re.qweatherapi.com"
}

Technical Analysis

The example configuration contains a realistic value explicitly identified as a QWeather privateKey, together with an application ID, credential ID, and account-specific API host. These values are presented as concrete credentials rather than unmistakable placeholders.

Documentation committed to a project is commonly copied, indexed, mirrored, cached, and retained in source-control history. If the displayed values are active, any party with access to this artifact could attempt to use them to authenticate to the associated QWeather service. Even if the values were intended only as examples, publishing realistic secret material creates a credential-management risk and makes it difficult for users and automated secret scanners to distinguish samples from live credentials.

No evidence in the reviewed file proves that the values are currently valid, and no credential-exfiltration behavior was identified. The exposure risk arises if they correspond to active or reusable credentials.

Attack Path

1. An attacker obtains the public or otherwise shared SKILL.md artifact.
2. The attacker extracts the private key, application ID, credential ID, and API host.
3. The attacker reproduces the QWeather authentication flow using the exposed values.
4. If the credentials are valid, the attacker submits authenticated requests to the specified API endpoint.
5. The attacker consumes the account's API quota or performs other operations allowed to that credential.

Impact Assessment

If valid, the exposed values could a ...[truncated 361 chars]

Remediation

View remediation

Remediation Suggestions

• Immediately determine whether the displayed values are real or have ever been active.
• Revoke and rotate the private key and related credentials if validity cannot be conclusively ruled out.
• Review QWeather access logs, usage records, quota consumption, and billing data for unauthorized activity.
• Replace every concrete value with an unmistakable placeholder, such as YOUR_QWEATHER_PRIVATE_KEY, YOUR_APP_ID, and YOUR_CREDENTIAL_ID.
• Store operational secrets in a dedicated secret manager or protected local configuration excluded from source control.
• Restrict local credential-file permissions to the account that runs the skill.
• Add automated secret scanning to commit and release workflows.
• Remove exposed credentials from repository history and published package artifacts where feasible, while recognizing that history removal does not replace credential rotation.
• Apply provider-side restrictions, least-privilege scopes, quota limits, and monitoring to reduce the impact of future exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The sample JSON exposes realistic-looking private key and credential values in plain text, which can be mistaken for valid secrets or encourage users to embed real authentication material directly in files. In a network-enabled weather skill that authenticates to an external provider, leaked credentials could enable unauthorized API access, billing abuse, or compromise of the associated third-party account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation includes a configuration example containing what appears to be live-style authentication material, including a private key and identifiers, without any warning that these values must be secret and must never be committed to source control. Even if the sample values are placeholders, presenting them in realistic form normalizes unsafe credential handling and increases the chance that users will copy real secrets into local files or repositories.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.