Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent fishing-location helper, but it automatically extracts precise photo GPS data and sends coordinates to a weather service without clear user consent.
Install only if you are comfortable with uploaded photos being checked for embedded GPS coordinates and those coordinates being used for weather lookup. A safer version should ask before reading EXIF GPS, explain that coordinates may be sent to Open-Meteo, and allow city-level location instead of exact coordinates.
The description declares activation on phrases such as "帮我分析钓点" and especially broader variants like "这个地方钓鱼怎么样", which could easily appear in normal chat rather than as an intentional skill invocation. The file does not provide exclusion conditions or negative examples to constrain when the skill should or should not auto-start.
The trigger block says the skill automatically starts when the user enters any listed phrase, including short generic variants like "分析钓点" and "钓鱼选点". Because there are no boundaries on context, channel, or intent, these phrases are broad enough to cause unintended invocation during routine discussion.
The skill instructs automatic extraction of EXIF GPS from user photos and use of that location for downstream analysis without a prior user-facing privacy notice or consent step. Precise location metadata can reveal sensitive whereabouts such as home, habitual fishing spots, or travel patterns, and users may not realize that embedded metadata is being processed.
The skill sends latitude and longitude to an external weather API, which is an external transmission of sensitive location data. Even though the destination is a legitimate weather service, sharing precise coordinates with a third party can expose user location unnecessarily, especially when combined with automatic EXIF extraction.
使用 web_fetch 调用 Open-Meteo API 获取实时天气：
URL: https://api.open-meteo.com/v1/forecast?latitude={lat}&longitude={lon}¤t=temperature_2m,relative_humidity_2m,surface_pressure,wind_speed_10m,wind_direction_10m,precipitation&timezone=auto&forecast_days=1
无需 API Key，直接 GET 请求即可。
No suspicious patterns detected.