Weathercli

• Analyzed: May 13, 2026, 3:01 AM
• Findings: 1
• Version: 0.1.0
• Hash: 3538928fd2d6545d992671fde7e5cb104578e0b1ded4eb50e45bf6166d1bd27d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `SKILL.md` file includes explicit instructions for installing the `weathercli` tool using `go install github.com/pjtf93/weathercli/cmd/weathercli@latest` if it's not available. While the stated purpose of the skill is benign (retrieving weather information), instructing an AI agent to fetch and execute code from an external GitHub repository represents a supply chain risk. This is a risky capability without clear malicious intent, as it allows arbitrary code execution from an external source, fitting the criteria for 'suspicious'.