Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward BMKG weather and earthquake lookup helper, with expected network calls to BMKG and no evidence of hidden persistence, credential access, or destructive behavior.
Install this if you want an agent to answer Indonesian weather and earthquake questions using BMKG data. Be aware it will contact BMKG public endpoints with the relevant region code or requested location context, and ambiguous weather requests in Indonesian may activate it.
The skill instructs use of shell commands and outbound network access (python scripts/..., curl ...) but does not declare any explicit tool scope or permissions. This creates a governance gap where an agent may execute capabilities broader than reviewers or policy expect, increasing the chance of unintended command execution or network use.
The trigger language is very broad, covering generic weather and Indonesian terms, so the skill may activate for loosely related prompts and cause unintended external lookups. Over-broad invocation expands the situations in which network actions or scripted lookups occur without the user specifically asking for BMKG data.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
GET https://data.bmkg.go.id/peringatan-dini-cuaca/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
GET https://data.bmkg.go.id/peringatan-dini-cuaca/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
GET https://data.bmkg.go.id/peringatan-dini-cuaca/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
GET https://data.bmkg.go.id/peringatan-dini-cuaca/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
GET https://data.bmkg.go.id/peringatan-dini-cuaca/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
GET https://data.bmkg.go.id/peringatan-dini-cuaca/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def test_kode(kode: str) -> dict | None:
"""Test apakah kode valid dengan hit API BMKG."""
url = f"https://api.bmkg.go.id/publik/prakiraan-cuaca?adm4={kode}"
try:
req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
with urllib.request.urlopen(req, timeout=10) as response:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def test_kode(kode: str) -> dict | None:
"""Test apakah kode valid dengan hit API BMKG."""
url = f"https://api.bmkg.go.id/publik/prakiraan-cuaca?adm4={kode}"
try:
req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
with urllib.request.urlopen(req, timeout=10) as response:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def test_kode(kode: str) -> dict | None:
"""Test apakah kode valid dengan hit API BMKG."""
url = f"https://api.bmkg.go.id/publik/prakiraan-cuaca?adm4={kode}"
try:
req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
with urllib.request.urlopen(req, timeout=10) as response:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def test_kode(kode: str) -> dict | None:
"""Test apakah kode valid dengan hit API BMKG."""
url = f"https://api.bmkg.go.id/publik/prakiraan-cuaca?adm4={kode}"
try:
req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
with urllib.request.urlopen(req, timeout=10) as response:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def test_kode(kode: str) -> dict | None:
"""Test apakah kode valid dengan hit API BMKG."""
url = f"https://api.bmkg.go.id/publik/prakiraan-cuaca?adm4={kode}"
try:
req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
with urllib.request.urlopen(req, timeout=10) as response:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def test_kode(kode: str) -> dict | None:
"""Test apakah kode valid dengan hit API BMKG."""
url = f"https://api.bmkg.go.id/publik/prakiraan-cuaca?adm4={kode}"
try:
req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
with urllib.request.urlopen(req, timeout=10) as response:
The instruction "Always mention 'Sumber: BMKG' in responses" mandates a specific language form in all outputs. This can violate language/locale policy expectations when the user is interacting in another language and no opt-in or alternative localized wording is offered.