Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Hong Kong weather lookup tool that only calls the official HKO open data API and does not show hidden persistence, credential access, or unrelated behavior.
Install this if you want Hong Kong-only weather data from HKO. Be aware it makes live network requests to data.weather.gov.hk and may answer in Traditional Chinese when language preference is unclear.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Data source: Hong Kong Observatory Open Data API (data.weather.gov.hk)
- No API key required
- Response time: typically 2-5 seconds
- When no warnings are active, the warning command returns "No active weather warnings" / "現時無生效天氣警告"
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Data source: Hong Kong Observatory Open Data API (data.weather.gov.hk)
- No API key required
- Response time: typically 2-5 seconds
- When no warnings are active, the warning command returns "No active weather warnings" / "現時無生效天氣警告"
Without declared permissions the skill's intent is opaque and cannot be validated.
The language handling policy explicitly says to default to tc when language is unclear because it is Hong Kong's primary language. This is a natural-language locale policy choice applied without asking the user, which conflicts with the requirement not to force a specific language or locale without opt-in.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from datetime import datetime
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"
# Weather icon mapping (simplified)
ICON_DESC_TC = {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from datetime import datetime
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"
# Weather icon mapping (simplified)
ICON_DESC_TC = {
The script sets the default language to "tc" and also silently falls back to "tc" when the user provides an unsupported language. This enforces a specific locale choice unless the user explicitly overrides it, which matches the policy category for language or locale constraints without opt-in.
No suspicious patterns detected.