Weather data loader (both history and forecast)

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:20 AM UTC
• Version: 1.0.1

Overview

This weather skill appears purpose-aligned and benign, though it sends locations or coordinates to Open-Meteo and uses unpinned Python dependencies.

Before installing, understand that any location name or coordinates you provide may be sent to Open-Meteo services. Use an isolated Python environment, consider pinning dependencies or adding a lockfile, and add request timeouts if you will run it in automation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:4

Finding

Unbounded Third-Party Dependency Versions Create Supply-Chain Risk

Content

View full analysis

=2.0.0 requests>=2.31.0 ``` ### Technical Analysis The project specifies only minimum versions for `pandas` and `requests`. It does not use exact version pins, upper bounds, lock files, or package hashes. Consequently, `pip install -r requirements.txt` may install any future release that satisfies these constraints. This makes installations non-reproducible and expands the dependency supply-chain trust boundary beyond the versions reviewed with the project. If a future dependency release or its distribution account is compromised, users may automatically install attacker-controlled package content. The package names are legitimate and no currently malicious dependency was identified. The risk arises from unrestricted future version resolution rather than demonstrated typosquatting or dependency confusion. ### Attack Path 1. An attacker compromises the publishing account, release pipeline, or distribution artifact of a permitted dependency version. 2. A user follows the documented installation command: `pip install -r requirements.txt`. 3. Package resolution selects the compromised release because it satisfies the minimum-only version constraint. 4. Malicious installation hooks or imported runtime code execute in the user's environment. 5. The payload gains the same operating-system permissions and data access as the user performing the installation or running the Skill. ### Impact Assessment Successful exploitation could result in arbitrary Python code execution under the installing or executing user's privileges. Depending on that account's permissions, this could expose project files, environment variables, credentials accessible to the process, and network resources. It could also allow modification of the Python environment or other user-writable files. The pro ...[truncated 115 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/utils.py:80

Finding

External HTTP Requests Lack Connection and Read Timeouts

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The metadata and description do not fully align with the behavior described in the skill body, especially around forecast support and additional derived agricultural metrics like crop coefficient and evapotranspiration. Description/behavior mismatch is dangerous because it can mislead users, reviewers, or automated policy systems about what the skill actually computes or accesses, reducing informed consent and making hidden functionality harder to detect.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises executable behaviors that imply shell, network, and likely file output capabilities, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: an orchestrator or reviewer cannot easily constrain what the skill is allowed to do, increasing the chance of over-privileged execution or unsafe invocation in environments that rely on manifest-declared limits.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/utils.py (reported line 22)May include surrounding context.

python

MAX_FORECAST_DAYS = 15

FORECAST_ENDPOINT_METEO = (
    "https://api.open-meteo.com/v1/forecast?latitude={lat}"
    "&longitude={lon}"
    "&forecast_days={forecast_days}"
    "&hourly=temperature_2m,relative_humidity_2m,precipitation,"

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_scripts.py (reported line 106)May include surrounding context.

python

try:
        cmd = [sys.executable, str(script_path)] + args
        result = subprocess.run(
            cmd,
            capture_output=True, text=True, timeout=30,
        )

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to submit location names and coordinates to the skill but does not clearly disclose that those inputs are transmitted to third-party Open-Meteo weather and geocoding services. This is a real privacy/transparency issue because users may unknowingly send sensitive location data to external providers, though the impact is limited by the skill’s ordinary weather-fetching context and the absence of direct code execution or credential handling in this file.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency is specified with a lower bound only, so installations can resolve to different future versions over time. This weakens reproducibility and can unintentionally pull in a compromised or breaking release from the package ecosystem, increasing supply-chain risk.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# Weather Fetcher Skill Dependencies
# Install with: pip install -r requirements.txt

pandas>=2.0.0
requests>=2.31.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The requests package is not pinned to an exact version, which allows dependency resolution to select newer versions unpredictably. This creates a supply-chain exposure window where a vulnerable or malicious release could be installed without changes to the skill code.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

# Install with: pip install -r requirements.txt

pandas>=2.0.0
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring at L006 says the functions are self-contained and do not depend on external modules. In reality, the module imports pandas and requests and uses requests to call Open-Meteo endpoints, so the documentation actively contradicts the implementation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code sends the user-provided location string to the external geocoding service via requests.get, which is a data transmission operation covered by the warning requirement for code files. Although the module docstring says it fetches weather data, there is no function-level comment, prompt, or user-facing notice indicating that location input will be sent to a third-party API.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.