Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches BirdWeather station data and optionally stores local trend history, with no deceptive or destructive behavior found.
Install only if you are comfortable giving the agent a BirdWeather station token and letting it query that station's public read-only detections and sensor readings. Use the SQLite options only with a database path you choose, and avoid setting up recurring logging unless you want local history retained over time.
The skill documents network access to BirdWeather API endpoints but does not declare an explicit tool scope such as permissions or allowed-tools. Missing scope declarations weaken policy enforcement and reviewability, increasing the chance the skill is invoked with broader network capability than intended or approved.
The trigger phrases include broad, everyday language such as 'backyard birds,' which can cause the skill to activate in contexts the user did not intend. Unintended activation can lead to unexpected network requests and disclosure of station-specific data or use of a provided token when the conversation was only loosely related.
The manifest description emphasizes accessing station data, recent detections, sensor readings, historical trends, and alerts, which suggests read-oriented retrieval. However, the log command writes sensor snapshots and species metadata into a local SQLite database, adding persistent storage behavior not described in the manifest.
The manifest says the skill can help with first-time species alerts, but it does not explain that this is implemented by reading a local SQLite catalog of previously seen species. This introduces hidden stateful behavior beyond straightforward API access, which matters for user and developer intent.
The setup text states "BirdWeather tokens are public (no auth required for read access)," yet the manifest and command examples consistently require passing a token. This is an active documentation contradiction about how access works, which could mislead users about the skill's access model.
No suspicious patterns detected.
