Security audit
Security checks for vulnerabilities and agentic risk
This weather skill uses a Google API key to send requested locations to Google for weather and geocoding, which matches its stated purpose and is disclosed in the skill documentation.
Install only if you are comfortable providing a Google API key and having the locations you ask about sent to Google for geocoding and weather lookup. Review API key restrictions and billing controls in Google Cloud before use.
The module performs network calls to Google APIs via requests.get, yet the static finding says network capability is not covered by declared permissions. Undeclared network access creates a trust and containment problem: the same mechanism used for weather lookups could also transmit sensitive user input or secrets externally without platform enforcement.
The module performs network calls to Google APIs via requests.get, yet the static finding says network capability is not covered by declared permissions. Undeclared network access creates a trust and containment problem: the same mechanism used for weather lookups could also transmit sensitive user input or secrets externally without platform enforcement.
The file embeds Hebrew-specific condition translations and hardcodes quick-lookup locations exclusively for Israeli cities, which indicates a locale-specific default behavior. Because this regional/language bias is not clearly documented as an opt-in or region-specific tool, it may violate language/locale policy expectations.
User-supplied location data is sent to Google Geocoding and Weather APIs, but the code provides no disclosure or consent flow before transmitting that data externally. Location information can be sensitive, and silent third-party sharing may violate user expectations, privacy requirements, or enterprise data-handling rules.
The skill reads API credentials from environment variables and uses them in network requests to Google services. Although this is expected for API integration, the file lacks a user-facing warning or explanatory note that the skill depends on external credentials and will use them for outbound API calls.
No suspicious patterns detected.
