OpenWeatherMap Weather

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward weather skill that uses OpenWeatherMap as disclosed and does not include hidden code or installation behavior.

Install only if you are comfortable sharing weather query locations with OpenWeatherMap and providing an API key. Prefer city-level queries over precise coordinates when possible, and use a dedicated API key that can be rotated if exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

External Transmission

Medium

Category: Data Exfiltration
Content: ### By City Name ``` GET https://api.openweathermap.org/data/2.5/weather?q={city},{country_code}&appid={API_KEY}&units={units} ``` ### By Coordinates
Confidence: 89% confidence
Finding: https://api.openweathermap.org/

External Transmission

Medium

Category: Data Exfiltration
Content: ### By Coordinates ``` GET https://api.openweathermap.org/data/2.5/weather?lat={lat}&lon={lon}&appid={API_KEY}&units={units} ``` ### Parameters
Confidence: 89% confidence
Finding: https://api.openweathermap.org/

External Transmission

Medium

Category: Data Exfiltration
Content: ## Forecast API (5 Day / 3 Hour) ``` GET https://api.openweathermap.org/data/2.5/forecast?q={city}&appid={API_KEY}&units=imperial ``` Returns forecast data in 3-hour intervals for 5 days.
Confidence: 86% confidence
Finding: https://api.openweathermap.org/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal