Security audit

China Weather

Security checks for vulnerabilities and agentic risk

Overview

This is a weather-query skill with expected external API use, but users should understand that city queries and any configured weather API keys are sent to third-party weather services.

Install only in an environment where external weather lookups are acceptable. Treat city names as shared with wttr.in or the configured weather provider, use a trusted QWeather host issued by the provider, keep API keys low-privilege, and prefer installing dependencies in an isolated environment with pinned versions if possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:276
Finding: Configurable API Host Can Exfiltrate QWeather Credentials
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:103
Finding: Unpinned Runtime Installation of a Third-Party Dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest claims the skill supports life index data along with current weather, forecast, and air quality, but the runnable code only implements WttrAPI and QWeatherAPI classes and never fetches any life-index endpoint. Although the formatter can display an 'indices' field if present, no code populates it, and the advertised Seniverse/OpenWeatherMap fallback providers are referenced but not implemented.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Overly broad trigger phrases increase the chance the skill activates unintentionally during ordinary conversation, causing unsolicited network requests to external APIs. In an agent environment, accidental invocation can leak user intent or contextual location information and create confusing or surprising behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill describes third-party API usage but does not clearly warn that user-provided city inputs are sent off-platform to external weather providers. This lack of transparent disclosure can lead to privacy violations, especially when users assume queries are processed locally or only by the host assistant.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.
text
permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The example usage hard-codes lang='zh', which imposes a specific language choice in the documented behavior even though the skill advertises both Chinese and English support. There is no accompanying instruction to ask the user for language preference before selecting Chinese output.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill transmits user-supplied city queries to external third-party weather services, but the security note understates the privacy implication by framing this as essentially no external upload beyond API calls. Users may not realize their location interests or query patterns are disclosed to outside services, which matters in privacy-sensitive environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.