Security audit
Security checks for vulnerabilities and agentic risk
This weather skill is a simple, disclosed set of weather-query instructions and does not show hidden execution, credential access, persistence, or unrelated data handling.
Installers should expect this skill to make outbound weather requests with the location they query. The artifact has some encoding/metadata quality issues, but no security-significant hidden behavior was found.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
name: weather-moji
description: "Get current weather and forecasts using Moji Weather for China-focused detailed forecasts"
tags: [domain-specific, general, api-integration, cli]
The description and main instructions explicitly position the skill as China-focused and present the usage/documentation in Chinese without indicating that users can choose another language or locale. This is a natural-language locale policy concern because the file imposes a specific language/region context rather than offering an opt-in or clearly documenting a justified region-only restriction.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Free, no key, good for programmatic use:
curl -s "https://api.open-meteo.com/v1/forecast?latitude=51.5&longitude=-0.12¤t_weather=true"
Find coordinates for a city, then query. Returns JSON with temp, windspeed, weathercode.
The Chinese heading at L45 states the following wttr.in documentation is 'deprecated' or 'abandoned', but the subsequent sections provide full operational curl examples, tips, and formats for wttr.in and Open-Meteo. This is an intent/documentation contradiction because the text frames the capability as no longer used while still instructing users to use it.
No suspicious patterns detected.