Security audit
Security checks for vulnerabilities and agentic risk
This is mostly a weather lookup skill, but its metadata incorrectly routes database and SQL tasks to it while requesting exec and write authority.
Review before installing. Use it only for weather lookups, and do not rely on its routing metadata for database, SQL, or storage tasks. Expect city names or coordinates to be sent to wttr.in or Open-Meteo, and avoid granting write access unless you need file export behavior.
Contradictory and overly broad activation guidance is a real security issue in agent skills because it affects invocation boundaries. Here, a weather tool is advertised for database/SQL/storage use, which can cause misrouting into a skill that exposes exec and write tools, increasing the chance of unintended command execution or data handling.
The shell example constructs a URL using unsanitized user-controlled input ($CITY) and executes network-fetching commands via curl. In practice this can enable option/argument injection or malformed-request abuse depending on how the value is supplied and interpreted, and it combines untrusted input with exec-capable behavior and external connectivity.
CITY=${1:-Beijing}
# ...
# 主数据源
result=$(curl -s --max-time 5 "wttr.in/$CITY?format=3" 2>/dev/null)
if [ -n "$result" ] && [ "$result" != *"Unknown"* ]; then
echo "$result"
exit 0
The manifest description mixes unrelated database/SQL/storage guidance into a weather-query skill, creating a scope-confusion issue. In an agent ecosystem, ambiguous or contradictory activation metadata can cause the wrong skill to be selected for sensitive tasks, leading the agent to invoke write/exec-capable behavior in contexts the user did not intend.
The examples perform outbound requests to third-party services but do not clearly warn users that city names, coordinates, and request metadata will be transmitted externally. In agent contexts, silent external transmission can violate user expectations, privacy requirements, or network policy controls.
The capability-coverage section claims support for database, SQL, and storage scenarios that are not implemented by the documented weather behavior. This broadens trigger scope and can mislead an agent into routing unrelated requests to a skill that has exec/write permissions and external network behaviors.
The fragmented keyword list includes generic trigger terms such as 'Use' and unrelated database phrases, without clear limits. In an automated skill-selection system, this makes the skill eligible for far more prompts than intended, increasing the risk of accidental execution of networked or shell-based actions.
This code sends latitude and longitude to api.open-meteo.com over the network. While external transmission is expected for a weather skill, it remains a real security/privacy concern because location data can be sensitive and the skill does not pair the transmission with strong disclosure, minimization, or consent controls.
def get_weather(lat, lon):
"""获取指定坐标的当前天气"""
url = (
f"https://api.open-meteo.com/v1/forecast"
f"?latitude={lat}&longitude={lon}¤t_weather=true"
)
with urllib.request.urlopen(url) as response:
The fallback example transmits coordinates to api.open-meteo.com without any user-consent flow or policy guardrails. Because it is embedded in an error-handling path, users may be less likely to realize their data is still being sent to a third party when the primary source fails.
# ...
# 备选数据源
echo "wttr.in 不可用,切换到 Open-Meteo..."
curl -s --max-time 5 "https://api.open-meteo.com/v1/forecast?latitude=39.9&longitude=116.4¤t_weather=true" 2>/dev/null | python -c "
import sys, json
try:
data = json.load(sys.stdin)
The dependency section normalizes direct unauthenticated access to third-party weather services, but does not mention privacy, logging, retention, or organizational network restrictions. This is lower severity than executable examples, yet it still encourages unrestricted outbound transmission without governance guidance.
- **完全无需API Key**:本工具包使用的所有数据源均为公开免费API
- **wttr.in**: 直接访问 `https://wttr.in/{city}`,无需任何认证
- **Open-Meteo**: 直接访问 `https://api.open-meteo.com/v1/forecast`,无需任何认证
- **无速率限制配置**:正常使用不会触发限流,高频请求建议增加缓存
### 可用性分类
The skill display name, summary, and examples are predominantly Chinese, and the configuration defaults the language to 'zh'. There is no explicit statement that users may choose another language, which can violate a language/locale choice policy when not justified as region-specific.