Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent weather helper that uses location-based web APIs as expected, with privacy disclosure and packaging issues to fix.
Install only if you are comfortable with entered locations being sent to Open-Meteo and NOAA being queried for space-weather data. The publisher should add explicit privacy disclosure, narrow the execution authority where possible, and repair atmos.py before use because it currently will not run as valid Python.
The code performs outbound network access to multiple third-party services, but the finding indicates this capability is not declared in the skill's permissions. Undeclared network access is a real security issue because it bypasses expected consent and review boundaries, and in this skill it transmits user-supplied location data to external APIs.
Comments and all human-mode output strings are written in Chinese, and the program provides no option for users to select another language or locale. This is a natural-language policy concern because it imposes a specific language without opt-in or documented regional justification.
User-provided location text is sent to an external geocoding service without any user-facing disclosure or consent flow. Even if the destination APIs are legitimate, location data is sensitive and silent transmission can violate privacy expectations and platform policy.
This is a true external transmission finding because the skill sends derived user location data (latitude/longitude) to a third-party weather API. In context, the transmission appears necessary for functionality and not malicious, but it still creates privacy and dependency risk if not properly disclosed and governed.
lon = geo_data["results"][0]["longitude"]
# 2. 真实气象接口
weather_url = f"https://api.open-meteo.com/v1/forecast?latitude={lat}&longitude={lon}¤t=temperature_2m,relative_humidity_2m,wind_speed_10m"
w_data = api_get(weather_url)
current = w_data.get("current", {})
result["outdoor_temp"] = current.get("temperature_2m", result["outdoor_temp"])
The header describes the skill as a purely perceptive component, implying passive sensing/reporting. However, compute_insights produces actionable recommendations such as turning on AC, heating, closing windows, and using an air purifier, which is advisory/intervention-oriented rather than strictly perception-only.
No suspicious patterns detected.