Security audit

air-quality-download

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple air-quality downloader with some documentation and dependency hygiene issues, but no artifact-backed malicious behavior.

Review the docs carefully before installing: use this as an Open-Meteo coordinate-based downloader, be aware that some documented options are not implemented, and prefer constraining requests to a current patched version. Do not provide WAQI tokens unless you intentionally modify or call the unused WAQI helper.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation describes network access and file creation/output behavior, but the manifest shown in this file does not declare corresponding permissions. Undeclared network and file-write capabilities reduce transparency and can bypass user or platform expectations about what the skill is allowed to do.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 86% confidence
Finding: A description-behavior mismatch is security-relevant because the skill is presented as Open-Meteo-only, while static analysis indicates it may also contact WAQI and support token-based access not disclosed in the description. Hidden external integrations can expose user data to additional third parties and introduce unreviewed authentication or data-handling paths.

Description-Behavior Mismatch

Medium

Confidence: 74% confidence
Finding: The documentation introduces alternate city-based download behavior and CNEMC-related capabilities not reflected in the stated Open-Meteo-only scope. This inconsistency may hide additional data sources, query semantics, or network destinations, making the skill more dangerous than its declared purpose suggests.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0
Confidence: 94% confidence
Finding: requests>=2.28.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

Category: Supply Chain
Confidence: 78% confidence
Finding: requests==2.28.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_air-quality-download.py:14