File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/weather_daily.sh:11
Security audit
Weather Daily
Security checks across malware telemetry and agentic risk
Overview
This skill appears to do the advertised weather-note update with limited local file writing, but users should notice that its API-key handling is less strong than the security notes claim.
Install only if you are comfortable giving the skill an OpenWeatherMap API key and allowing it to append files under your Obsidian daily-note directory or the configured WEATHER_DAILY_OUTPUT_DIR. Consider using a limited weather API key because the implementation passes the key as a curl argument/query parameter despite stronger wording in the security notes.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.exposed_secret_literal