KnowAir Forecast 明气预报

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:19 PM UTC
• Version:
  1.0.0

Overview

This is a straightforward weather forecast skill that uses a disclosed Caiyun API token and user-provided coordinates to retrieve forecasts.

Install only if you are comfortable using a Caiyun API token and sending requested longitude/latitude coordinates to Caiyun for weather lookups. Use a dedicated token if possible and avoid querying exact private locations when approximate locations are sufficient.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger description is broad enough to match many ordinary weather-related requests, which can cause over-activation. While not a direct code-execution flaw, excessive activation increases the chance of unnecessary third-party API calls, unintended location sharing, and surprising behavior when users did not explicitly intend to use this external skill.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation does not clearly warn users that forecast requests are sent to an external weather provider and authenticated with an API token. In a weather skill, location data is inherently sensitive enough to warrant disclosure, and missing notice undermines informed consent and privacy expectations.

VirusTotal

65/65 vendors flagged this skill as clean.