Security audit

Tempest Weather

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended to fetch Tempest weather data, but it can use a personal station token for broad weather requests and may expose precise station location details beyond its documented output.

Review before installing if your Tempest station is at a home or sensitive location. Use a limited token if available, keep token-bearing URLs out of logs and shell history, prefer environment variables over command-line token flags, and be aware that generic weather questions may use your configured station data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_tempest.py:145
Finding: Tempest API token may be exposed through command-line arguments and URL query strings
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/fetch_tempest.py:87
Finding: Precise station coordinates are disclosed beyond the documented output schema
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 19)May include surrounding context.
md
- Python 3 - `curl` or `requests` (`pip install requests`) - A [Tempest Personal Access Token](https://tempestwx.com) and Station ID ## Setup

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
- Python 3 - `curl` or `requests` (`pip install requests`) - A [Tempest Personal Access Token](https://tempestwx.com) and Station ID ## Setup

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README.md (reported line 29)May include surrounding context.
Find your Station ID:

bash
curl -s "https://swd.weatherflow.com/swd/rest/stations?token=YOUR_TOKEN" | python3 -m json.tool

Look for "station_id" in the response.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This content directly describes use of a personal access token and where to obtain it, while also stating it must be sent as a query parameter. Although this appears to be normal product documentation rather than an attempt to steal credentials, it still promotes a credential-handling pattern that increases exposure risk and could lead to token compromise if copied into client code, logs, or debugging output. The weather-skill context makes this more dangerous because secrets may be handled by low-scrutiny automation for a seemingly harmless data source.
Content: Scanner excerpt · references/obs_fields.md (reported line 174)May include surrounding context.
md
All requests require `?token=YOUR_TOKEN` as a query parameter. - **Personal Access Token**: Generated at tempestwx.com → Settings → Data Authorizations → Create Token - **OAuth**: For multi-user applications (see Tempest OAuth docs) Token is passed as a query param, not a header.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill performs network access and reads sensitive environment variables but does not declare any explicit tool scope or permissions boundary. That increases the chance the agent can invoke this skill with broader-than-expected capabilities, making credential use and outbound requests less transparent and harder to govern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger language is broad enough to match generic weather and outdoor-condition questions, even when the user did not intend to use a personal Tempest station or disclose station-linked data. This can cause unintended activation of a networked skill that uses private credentials and returns potentially sensitive location-associated sensor data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation instructs users to place a personal access token in the URL query string. Query-string credentials are commonly exposed through logs, browser history, proxy caches, monitoring systems, referrer leakage, and shared screenshots, making accidental credential disclosure more likely. In this skill context, the risk is somewhat elevated because the skill is specifically about live API access and may encourage direct copying of example URLs into tools and agent workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file documents that the skill requires a Tempest Personal Access Token and sets it in environment variables, and it also states that the skill fetches live weather data from the Tempest REST API. Under the markdown-file criteria for missing user warnings, the description lacks an explicit warning about storing credentials in shell startup files and sending station/account-linked data to an external service.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.