Weather

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:38 AM UTC
• Version: 1.0.0

Overview

This skill only provides weather lookup instructions using wttr.in, with a minor transport-security concern in its curl examples.

Safe to install for simple weather lookups, but prefer using https://wttr.in URLs and avoid relying on it for severe weather, aviation, marine, or safety-critical decisions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:42

Finding

Weather Requests Use Unencrypted HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:42-48, SKILL.md:55-62, SKILL.md:69-76, SKILL.md:91, SKILL.md:97, SKILL.md:103, and SKILL.md:112
Vulnerability Type: Plaintext HTTP communication
Risk Level: Medium

The affected command examples omit the URL scheme:

bash

curl "wttr.in/London?format=3"
curl "wttr.in/London?0"
curl "wttr.in/New+York?format=3"

curl "wttr.in/London"
curl "wttr.in/London?format=v2"
curl "wttr.in/London?1"

curl "wttr.in/London?format=%l:+%c+%t+%w"
curl "wttr.in/London?format=j1"
curl "wttr.in/London.png"

curl -s "wttr.in/London?format=%l:+%c+%t+(feels+like+%f),+%w+wind,+%h+humidity"
curl -s "wttr.in/London?format=%l:+%c+%p"
curl "wttr.in/London?format=v2"
curl wttr.in/ORD

Technical Analysis

When curl receives a URL without an explicit scheme, it normally interprets the destination as HTTP. Consequently, the initial weather request and its location parameters can be transmitted without transport encryption or server authentication.

An attacker with a network position, such as an operator of a hostile wireless access point or a compromised intermediary, can observe the requested location and intercept or modify the HTTP response. Even if the service normally redirects clients to HTTPS, the initial plaintext response can itself be manipulated when redirect enforcement and validation are not guaranteed by the command. The examples also do not use --fail to ensure HTTP errors are handled as failures.

The declared homepage uses HTTPS, demonstrating that an encrypted endpoint is available, but the command examples do not explicitly require it.

Attack Path

1. A user requests weather information for a city, region, or airport.
2. The Agent follows the Skill instructions and executes a scheme-less curl command.
3. curl initiates an unencrypted HTTP request containing the requested location.
4. A network-positioned attacker intercepts ...[truncated 610 chars]

Remediation

View remediation

Remediation Suggestions

Replace every scheme-less endpoint with an explicit HTTPS URL. Add error-handling options so failed or unexpected HTTP responses are not silently treated as valid weather data:

bash

curl --fail --silent --show-error "https://wttr.in/London?format=3"

Apply the following hardening measures consistently:

1. Require https://wttr.in/ in every command example.
2. Use --fail --silent --show-error so transport and HTTP errors are surfaced.
3. If redirects are required, use --location together with --proto '=https' and --proto-redir '=https' to prevent downgrade redirects.
4. URL-encode user-provided locations rather than directly inserting raw input into a shell command.
5. Avoid disabling TLS certificate verification through options such as --insecure.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.