彩云天气 / Caiyun Weather

• Outcome: Pass
• Latest audit: May 28, 2026, 10:34 AM
• Version:
  1.2.0

Overview

This appears to be a straightforward weather skill that uses a disclosed Caiyun API token and online weather/geocoding services.

Install only if you are comfortable providing a Caiyun Weather API token and sending requested city names or coordinates to Caiyun Weather, with unmatched city names resolved through OpenStreetMap Nominatim. Avoid querying sensitive precise locations if that disclosure is a concern.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly requires an environment variable secret (`CAIYUN_WEATHER_API_TOKEN`) and performs outbound network requests to Caiyun Weather and OpenStreetMap geocoding, but it does not declare corresponding permissions. This creates a transparency and governance gap: the runtime may expose secrets and allow network access without explicit permission review, which is risky even though the described functionality is legitimate for a weather API skill.

VirusTotal

67/67 vendors flagged this skill as clean.