Security audit
Whale Weather 🐳
Security checks for vulnerabilities and agentic risk
Overview
This is a small weather lookup skill that only runs local scripts to query Open-Meteo for city forecasts.
Before installing, understand that weather queries will run the included scripts locally, invoke python3, and send the city name or lookup term to Open-Meteo over the network. No evidence of hidden credential access, persistence, destructive behavior, or unrelated data handling was found.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.