Back to skill

Security audit

Hong Kong Weather Information

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Hong Kong weather helper that fetches public HKO weather data and caches it locally, with no evidence of hidden or destructive behavior.

Install only if you are comfortable with the agent making live requests to HKO weather endpoints and writing a small local cache in your home directory. Use the language option if you do not want the default Traditional Chinese output.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

md
2. **Rate limiting** — respectful polling, cache results for 10-15 minutes
3. **Regional name matching** — use partial case-insensitive match. Some station names differ from district names
4. **UV index** — may be null at night or on cloudy days
5. **Warning message** — may be empty string if no warnings active
6. **Forecast language** — the `lang` parameter affects all text fields
7. **Rainfall entries may lack `value` key** — always check `"value" in matched` before accessing. Some stations report empty/missing rainfall data differently.
8. **`forecastPeriod` is a string, not an array** — the `flw` API returns `forecastPeriod` as a string (wind direction letters), NOT an array of forecast period objects. Use `forecastDesc` for the human-readable forecast text.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs use of network access, local file caching, and reading a reference file/script, but it does not declare any explicit tool scope or permissions boundary. That makes the operational capabilities broader and less auditable than the metadata suggests, increasing the chance an agent executes network or filesystem actions without informed policy review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to default to tc (Traditional Chinese) unless the user specifies otherwise. This forces a specific language choice without explicit user opt-in, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instruction to run a local shell command to determine time introduces unnecessary command execution for a weather lookup skill. Even though the specific command is simple, requiring shell access expands the attack surface and normalizes executing host commands when the same information could be obtained from safer built-in time APIs.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/1min-temp-csv.md (reported line 7)May include surrounding context.

md
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/1min-temp-csv.md (reported line 8)May include surrounding context.

md
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/1min-temp-csv.md (reported line 9)May include surrounding context.

md
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/hk_weather.py (reported line 18)May include surrounding context.

python
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/hk_weather.py (reported line 22)May include surrounding context.

python
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/hk_weather.py (reported line 23)May include surrounding context.

python
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/hk_weather.py (reported line 24)May include surrounding context.

python
from datetime import datetime, timedelta

# HKO OpenData API — free, no key required
BASE_URL = "https://data.weather.gov.hk/weatherAPI/opendata/weather.php"

# 1-minute temperature CSV URLs by language
CSV_URLS = {

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The instruction says that when a user provides an English region name, it should be mapped to Chinese station name fragments. This imposes a specific locale handling rule in natural language without indicating user opt-in or explaining that the underlying data source is inherently Chinese-labeled, which fits the language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The usage text and examples state that Traditional Chinese is the default output language, and the script later enforces that default via the --lang argument. This is a natural-language locale policy concern because the skill selects a specific language by default rather than prompting for or negotiating user preference.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.