Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward weather-query skill for one UAPI endpoint, with no local code execution or persistence, though users should be aware of external API calls and possible IP-based location lookup.
Before installing, understand that weather lookups may contact https://uapis.cn and, if you do not provide a city or adcode, the service may infer location from the client IP. Provide an explicit city/adcode for better control, and only add a UAPI Key if you are comfortable using that service account.
The English trigger list includes very broad terms such as "weather" and "weather api", which can cause this skill to be selected for loosely related requests rather than only for the specific GET /misc/weather operation. In an agent setting, overbroad routing can lead to unintended API calls, incorrect handling of user intent, and leakage of user context to an unnecessary external service.
The skill explicitly states that if neither city nor adcode is provided, the service will infer location from the client IP, but it does not warn about the privacy implications of transmitting and processing location derived from IP. In an agent setting, this can cause location disclosure without clear user awareness or consent, especially when the agent silently falls back to auto-location instead of prompting for a city.
The document is written primarily in Chinese and instructs usage in that locale without offering any language choice or stating that the skill is region-specific. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
The description is primarily framed around Chinese trigger phrases and Chinese naming of the interface, while not explicitly stating that users may interact in their preferred language. This can be read as a locale/language bias without an explicit opt-in or justification.
No suspicious patterns detected.
