Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it fetches weather and sends generated forecast text to SenseAudio to create an audio file.
Before installing, understand that weather locations and generated broadcast text may be sent to third-party services, and your SenseAudio API key is used when calling SenseAudio. Avoid using precise home/work addresses or sensitive personal details in broadcast text.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
env:
- SENSEAUDIO_API_KEY
bins:
- curl
- jq
primaryEnv: SENSEAUDIO_API_KEY
homepage: https://senseaudio.cn/docs
The shell example sends weather-derived broadcast text to the external SenseAudio TTS endpoint. This is expected for a cloud TTS skill, but it remains a real data exposure path because the text may include user-provided location information and there is no warning, consent gate, or data sensitivity guidance.
BROADCAST_TEXT="天气播报：${WEATHER}。祝您出行愉快！"
# Call SenseAudio TTS / 调用 SenseAudio TTS
curl -X POST https://api.senseaudio.cn/v1/t2a_v2 \
-H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
-H "Content-Type: application/json" \
-d "{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Get coordinates first, then query / 先获取坐标，再查询
# Beijing: 39.9, 116.4
curl -s "https://api.open-meteo.com/v1/forecast?latitude=39.9&longitude=116.4¤t_weather=true"
Defining the external SenseAudio TTS endpoint in code is part of the mechanism that transmits generated text off-host. In context this is not malicious, but it contributes to a real third-party data flow involving potentially user-derived location/weather content and should be treated as an external transmission concern.
import os
SENSEAUDIO_API_KEY = os.environ.get("SENSEAUDIO_API_KEY")
TTS_URL = "https://api.senseaudio.cn/v1/t2a_v2"
def get_weather(city: str, lang: str = "zh") -> str:
"""Fetch weather from wttr.in / 从 wttr.in 获取天气"""
The Python example posts generated broadcast text to the external SenseAudio API, which means user-supplied or fetched content leaves the local environment. In context this is expected functionality, but it is still a genuine external data transmission risk because potentially sensitive location-derived text is sent to a third party without minimization or explicit consent handling.
}
}
resp = requests.post(TTS_URL, json=payload, headers=headers, timeout=30)
result = resp.json()
if result.get("data") and result["data"].get("audio"):
The skill sends location and weather-query data to third-party services (wttr.in and SenseAudio) but does not clearly warn users that their requested city and generated broadcast text will be transmitted externally. This is a real privacy/transparency issue, though the data involved is typically low sensitivity unless users supply precise or personal locations.