Tempest Weather

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:33 PM UTC
• Version: 1.0.0

Overview

The skill appears intended to fetch Tempest weather data, but it can use a personal station token for broad weather requests and may expose precise station location details beyond its documented output.

Review before installing if your Tempest station is at a home or sensitive location. Use a limited token if available, keep token-bearing URLs out of logs and shell history, prefer environment variables over command-line token flags, and be aware that generic weather questions may use your configured station data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_tempest.py:145
• Finding: Tempest API token may be exposed through command-line arguments and URL query strings<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch_tempest.py:5-11, 55-58, 145-146`; `README.md:27-30`; `SKILL.md:43-49, 61-64` **Vulnerability Type**: Credential exposure through process arguments, shell history, and URL-bearing telemetry **Risk Level**: Medium ### Complete Code Snippets `scripts/fetch_tempest.py:5-11`: ```python Usage: python3 fetch_tempest.py --token YOUR_TOKEN --station 12345 python3 fetch_tempest.py --token YOUR_TOKEN --station 12345 --pretty Environment variables (alternative to flags): TEMPEST_TOKEN TEMPEST_STATION_ID ``` `scripts/fetch_tempest.py:55-58`: ```python def fetch_observation(token, station_id): url = f"{BASE_URL}/observations/station/{station_id}" resp = requests.get(url, params={"token": token}, timeout=10) ``` `scripts/fetch_tempest.py:145-146`: ```python parser.add_argument("--token", default=os.environ.get("TEMPEST_TOKEN"), help="API token") parser.add_argument("--station", default=os.environ.get("TEMPEST_STATION_ID"), help="Station ID") ``` `README.md:27-30`: ```bash Find your Station ID: ```bash curl -s "https://swd.weatherflow.com/swd/rest/stations?token=YOUR_TOKEN" | python3 -m json.tool ``` ``` `SKILL.md:43-49`: ```text GET https://swd.weatherflow.com/swd/rest/observations/station/{STATION_ID}?token={TEMPEST_TOKEN} ``` Fallback (by device): `GET https://swd.weatherflow.com/swd/rest/observations/?device_id={DEVICE_ID}&token={TEMPEST_TOKEN}` To list available stations/devices: `GET https://swd.weatherflow.com/swd/rest/stations?token={TEMPEST_TOKEN}` ``` `SKILL.md:61-64`: ```bash curl -s "https://swd.weatherflow.com/swd/rest/observations/station/${STATION_ID}?token=${TEMPEST_TOKEN}" ``` ### Technical Analysis The WeatherFlow API requires the personal access token as a query parameter, so transmitting the token to the fixed official HTTPS endpoint is necessary for the declared functionality and is not unauthorized exfiltration. However, the Skill also encourages ...[truncated 1859 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove or deprecate the `--token` option so credentials are not accepted directly through process arguments. 2. Prefer `TEMPEST_TOKEN` or a permission-restricted configuration file. Document that the environment variable is the recommended method. 3. If interactive operation is required, read the token with `getpass.getpass()` rather than from a visible command-line argument. 4. Warn users not to replace `YOUR_TOKEN` with a literal credential in commands retained by shell history. 5. Where curl must be used, obtain credentials from protected configuration and ensure command tracing such as `set -x` is disabled. 6. Ensure application, proxy, and diagnostic logging redacts the `token` query parameter. 7. Use narrowly scoped tokens where supported and document immediate token rotation after suspected exposure. 8. Retain HTTPS certificate verification and the fixed WeatherFlow origin; both are already provided by the current implementation. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/fetch_tempest.py:87
• Finding: Precise station coordinates are disclosed beyond the documented output schema<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch_tempest.py:87-94` **Vulnerability Type**: Excessive disclosure of precise location data **Risk Level**: Low ### Complete Code Snippet ```python return { "station_id": data.get("station_id"), "station_name": data.get("station_name") or data.get("public_name"), "latitude": data.get("latitude"), "longitude": data.get("longitude"), "timezone": data.get("timezone"), "elevation_m": data.get("elevation"), "timestamp": ts_iso, ``` ### Technical Analysis The script copies exact latitude and longitude values from the WeatherFlow response into its normalized output. These fields are not included in the output schemas documented in `README.md` or `SKILL.md`, and precise coordinates are not required to answer the declared current-weather, rain, wind, lightning, or UV queries. Although the script does not acquire location data from an unrelated source, propagating coordinates into the agent response expands the amount of sensitive information exposed to transcripts, logs, downstream tools, and users. This exceeds the minimum data disclosure necessary for the Skill's stated functionality. ### Attack Path 1. A user asks the Skill for current station weather. 2. The script requests the station observation from the legitimate WeatherFlow API. 3. The API response includes station latitude and longitude. 4. The script copies those coordinates into its JSON output without requiring an explicit location request. 5. An agent transcript, logging system, downstream integration, or person with access to the response obtains the precise station location. No separate code-execution exploit is required; the disclosure occurs during normal use. ### Impact Assessment The issue does not provide system privileges, account modification, or code execution. It may disclose the precise physical location of a private weather station, potentially identifying a user's home or another sensitive in ...[truncated 255 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `latitude` and `longitude` from the default normalized response. 2. Return only fields needed for the user's weather request. 3. If coordinates are a legitimate optional feature, require an explicit opt-in argument or an explicit user request. 4. Clearly document all location fields in the output schema and explain their privacy implications. 5. Consider returning a coarse region or timezone instead of exact coordinates where location context is needed. 6. Ensure agent transcripts and application logs apply appropriate access controls and retention limits to location-bearing responses. 7. Add tests confirming that default output does not contain exact station coordinates. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Credential Access

High

• Category: Privilege Escalation

Content

- Python 3
- `curl` or `requests` (`pip install requests`)
- A [Tempest Personal Access Token](https://tempestwx.com) and Station ID

## Setup

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Python 3
- `curl` or `requests` (`pip install requests`)
- A [Tempest Personal Access Token](https://tempestwx.com) and Station ID

## Setup

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

Find your Station ID:
```bash
curl -s "https://swd.weatherflow.com/swd/rest/stations?token=YOUR_TOKEN" | python3 -m json.tool
```
Look for `"station_id"` in the response.

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Credential Access

High

• Category: Privilege Escalation

Content

All requests require `?token=YOUR_TOKEN` as a query parameter.

- **Personal Access Token**: Generated at tempestwx.com → Settings → Data Authorizations → Create Token
- **OAuth**: For multi-user applications (see Tempest OAuth docs)

Token is passed as a query param, not a header.

• Confidence: 90% confidence
• Finding: This content directly describes use of a personal access token and where to obtain it, while also stating it must be sent as a query parameter. Although this appears to be normal product documentation rather than an attempt to steal credentials, it still promotes a credential-handling pattern that increases exposure risk and could lead to token compromise if copied into client code, logs, or debugging output. The weather-skill context makes this more dangerous because secrets may be handled by low-scrutiny automation for a seemingly harmless data source.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill performs network access and reads sensitive environment variables but does not declare any explicit tool scope or permissions boundary. That increases the chance the agent can invoke this skill with broader-than-expected capabilities, making credential use and outbound requests less transparent and harder to govern.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger language is broad enough to match generic weather and outdoor-condition questions, even when the user did not intend to use a personal Tempest station or disclose station-linked data. This can cause unintended activation of a networked skill that uses private credentials and returns potentially sensitive location-associated sensor data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to place a personal access token in the URL query string. Query-string credentials are commonly exposed through logs, browser history, proxy caches, monitoring systems, referrer leakage, and shared screenshots, making accidental credential disclosure more likely. In this skill context, the risk is somewhat elevated because the skill is specifically about live API access and may encourage direct copying of example URLs into tools and agent workflows.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This markdown file documents that the skill requires a Tempest Personal Access Token and sets it in environment variables, and it also states that the skill fetches live weather data from the Tempest REST API. Under the markdown-file criteria for missing user warnings, the description lacks an explicit warning about storing credentials in shell startup files and sending station/account-linked data to an external service.

Static analysis

No suspicious patterns detected.