alpinist-route-forecast

• Outcome: Review
• Latest audit: Jul 30, 2026 · 3:30 AM UTC
• Version: 1.0.1

Overview

The skill is coherent and not malicious, but it should be reviewed because it gives alpine safety/timing advice while overstating weather-source verification and lacking strong safety caveats.

Review before installing if you might use it for real climbs. Treat outputs as planning aids only, verify conditions with authoritative local sources and current guide/avalanche information, and be aware that GPX files, coordinates, route names, and calibration history may expose sensitive activity patterns.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tainted flow: 'req' from urllib.request.urlopen (line 861, network input) → urllib.request.urlopen (network output)

Medium

• Category: Data Flow

Content

# Step 2: Get hourly forecast
    try:
        req = Request(hourly_url, headers=headers)
        resp = urlopen(req, timeout=10)
        data = json.loads(resp.read())
        periods = data["properties"]["periods"]
    except Exception as e:

• Confidence: 84% confidence
• Finding: The code blindly follows the forecastHourly URL supplied by the first NOAA response and performs a second outbound request without host allowlisting. If the upstream response were compromised, intercepted in a hostile environment, or an unexpected redirect/data issue occurred, this could turn into unintended outbound access to attacker-controlled infrastructure.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill clearly instructs the agent to use internet access for multiple external weather sources and to write a local profile file for pace calibration, but it does not declare corresponding permissions. Undeclared network and file-write capabilities reduce transparency and informed consent, making it easier for users or reviewers to miss that route data is transmitted externally and that user-derived trip history is persisted locally.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill advertises 'three-source verification,' but the code only conditionally performs Mountain-Forecast and NOAA checks, and may produce output without all three sources. In a mountaineering safety context, overstating verification can cause users to place undue trust in weather guidance for high-risk decisions.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The confidence text says 'all 3 sources available' based solely on forecast horizon before confirming source availability or whether the user provided a peak needed for Mountain-Forecast lookup. That can mislead climbers into overconfidence and is especially dangerous given the life-safety context of alpine route planning.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Although the skill includes a privacy section, it frames GPX and coordinate sharing mainly as a functional disclosure and does not clearly warn that uploaded GPX tracks and summit coordinates can reveal sensitive location history, habits, and future plans. In a climbing context, route files may expose home areas, recurring patterns, or planned presence in remote locations, increasing privacy and personal safety risk if users are not adequately warned.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This file provides detailed route data for objectively hazardous alpine and technical climbing objectives, including glacier routes, technical cruxes, and timing cues, but does not include any explicit safety warnings, prerequisite experience guidance, or statements that conditions and route details can change. In the context of a route-aware weather and pace-planning skill, users may reasonably rely on this structured data for real trip decisions, increasing the risk of overconfidence, misuse by inexperienced users, and injury or death if route seriousness is understated.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

elif days_ahead > 16:
        print(f"Error: Date is {days_ahead} days out. Maximum forecast range is 16 days.", file=sys.stderr)
        print("  Days 1-7:  High confidence (Open-Meteo + NOAA + Mountain-Forecast)", file=sys.stderr)
        print("  Days 8-16: Low confidence (Open-Meteo only, no verification)", file=sys.stderr)
        sys.exit(1)
    
    # Set confidence level

• Confidence: 70% confidence
• Finding: This code makes an automated recommendation about forecast confidence and start timing that users may act on in a hazardous alpine setting. While not a classic exploit path, unsafely framed autonomous advice can contribute to physical risk if users interpret it as authoritative safety guidance.

Static analysis

No suspicious patterns detected.