AWEKAS Wetter API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:43 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward AWEKAS weather lookup that sends the provided API key to the expected weather API and does not show hidden persistence or unrelated data access.

Install only if you are comfortable giving this skill network access to AWEKAS and sending your AWEKAS API key to that service. Prefer supplying the key through an environment variable or secret manager rather than pasting it into commands or committing it to files, and consider asking the publisher to pin dependencies and include a lockfile.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

External Transmission

Medium

• Category: Data Exfiltration

Content

};
    }

    const url = new URL("https://api.awekas.at/current.php");
    url.searchParams.set("key", apiKey);

    if (args.station) {

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill documentation requires an AWEKAS API key but does not warn users that the value is sensitive or advise how it should be stored and supplied. This increases the chance that users will paste secrets into shell history, logs, shared scripts, or screenshots, leading to accidental credential exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"awekas"
  ],
  "dependencies": {
    "node-fetch": "^3.3.2"
  }
}

• Confidence: 95% confidence
• Finding: The dependency uses a caret range (^3.3.2), which allows newer minor/patch releases to be installed without explicit review. This weakens build reproducibility and can unintentionally pull in a vulnerable or breaking release through the supply chain, even though it is not an immediate exploit by itself.

Unverifiable Dependency: node-fetch has 3 known advisory(ies) (CVE-2022-0235 (node-fetch forwards secure headers to untrusted sites); CVE-2022-2596 (node-fetch Inefficient Regular Expression Complexity ); CVE-2020-15168 (The `size` option isn't honored after following a redirect in node-fetch)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: The manifest references node-fetch without an exact pinned version, while the package has known historical advisories. Because the allowed version range is not fixed, it is not possible to verify from this file alone whether installations will avoid affected releases, creating uncertainty and potential exposure to known dependency flaws.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: awekasCurrent.js:46