Pollen Monitor

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:29 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward China pollen lookup tool that sends city and date parameters to a weather endpoint and prints the returned report.

Install only if you are comfortable with a Chinese-language, mainland-China pollen tool that makes outbound requests to a weather data service using the city and date range you query. It does not appear to access local private data or modify the system.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents executable shell and Python usage but does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, this can lead to overbroad execution assumptions, making it easier for the skill to invoke shell-capable behavior without clear user or platform constraints.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill description and all usage instructions are written exclusively in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: All user-facing instructions and output in the file are written exclusively in Chinese, and the skill does not indicate any language selection or opt-in mechanism. This can violate a language/locale policy when a skill imposes a specific language without giving the user a choice.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

url = f"https://graph.weatherdt.com/ty/pollen/v2/hfindex.html?eletype=1&city={city_en}&start={start}&end={end}&predictFlag=true"
    
    try:
        result = subprocess.run(
            ['curl', '-s', url],
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The manifest describes a skill for querying pollen concentration levels and advice for cities in mainland China. While network access is expected for that purpose, spawning a subprocess to invoke `curl` adds command-execution capability that is not justified by the stated function and is materially broader than making a normal HTTP request in-process.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Comments, usage guidance, error messages, and report output are all fixed in Chinese, with no option for users to select another language. The policy requires avoiding forced language or locale constraints unless the limitation is explicitly justified or users can opt in.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The README is entirely written in Chinese and all examples, output, and usage notes assume Chinese-language interaction, including Chinese city names and Chinese output text. Under the policy rule, a language constraint should either offer user choice or be clearly justified as a region-specific tool; while the skill is China-focused, it does not explicitly state that Chinese is required or optional for users.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The script invokes `curl` to send a request to an external weather service, which transmits the user-supplied city parameter and query dates off-host. While the file header names the data source, the code path performing the network call has no runtime notice, confirmation, or comment warning the user that an outbound request will be made.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The script builds a remote API URL from the provided city argument and sends it via curl to an external service. Although this is core functionality, the file itself does not include any explicit user-facing notice that input values are sent to a third-party endpoint, beyond an internal comment about calling the API.

Static analysis

No suspicious patterns detected.