Qweather
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed QWeather lookup helper that uses a user-provided API key only for weather, air-quality, and alert queries for Chinese cities.
Install only if you are comfortable adding a QWeather API key to the skill config. Use the official QWeather API host from your QWeather console, keep the key private, and rotate it if it is exposed in logs or shared transcripts.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.