Security audit
Security checks for vulnerabilities and agentic risk
This is a purpose-aligned Chinese weather lookup skill that uses weather services and a small local city-code cache, with no evidence of hidden exfiltration, destructive behavior, or agent takeover.
Before installing, expect the skill to contact Chinese weather services with the city you query and to store newly discovered city-code mappings in its local citys.txt file. Avoid using it for locations you do not want cached locally, and treat the documented fallback services as additional third-party requests if used.
The declared purpose is a simple weather query tool, but the analyzer indicates extra behaviors including local persistence to citys.txt, online city-code lookups, and additional operational modes beyond the minimal description. This mismatch undermines informed consent and makes it easier to hide data storage or expanded external access behind an innocuous description.
The invocation examples are broad enough to match common everyday weather phrases, which can cause over-triggering and unintended skill activation. In an agent environment, overly generic routing increases the chance that networked or stateful behavior runs when the user did not specifically intend to invoke this skill.
The README states '必须使用中文', which imposes a language requirement on users. Under the policy, forcing a specific language without user opt-in or a clearly documented locale-specific justification is a natural-language policy violation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s "wttr.in/Beijing?T"
## ⚠️ 注意事项
The skill advertises networked behavior and, per the analyzer context, underlying code also reads and writes local files, yet the manifest declares no explicit tool scope or permissions. This creates a transparency and containment problem: a host may invoke a seemingly simple weather skill without clear authorization boundaries for filesystem and network access.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
### 🎛️ 参数说明：
| | | |
| ------------ | --------- | ------------------------------------------------------------------------------------------------------------------ |
| **参数** | **必填** | **作用描述** |
| `<地区名称>` | **✅ 是** | 你要查询的城市或者区县，比如：`北京`、`深圳`、`铁岭`。（支持地级市及大部分县级市） |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| | | |
| ------------ | --------- | ------------------------------------------------------------------------------------------------------------------ |
| **参数** | **必填** | **作用描述** |
| `<地区名称>` | **✅ 是** | 你要查询的城市或者区县，比如：`北京`、`深圳`、`铁岭`。（支持地级市及大部分县级市） |
| `-json` | ❌ 否 | **极客模式**：将输出格式转为结构化的 JSON 数据，非常适合喂给 AI 或被其他程序调用。 |
| `-today` | ❌ 否 | **只争朝夕模式**：无情裁掉未来 6 天的预报，屏幕上只保留“今天”的数据，界面极其清爽。 |
The documentation states "必须是中文" for region names, which imposes a language constraint on users. The file does not offer opt-in language choice or explain the restriction as a justified region-specific policy, so this is a natural-language locale policy issue.
The backup instructions direct requests to third-party services including open-meteo.com and wttr.in, causing user queries and metadata to be transmitted externally. External transmission is expected for a weather skill, but it becomes a security/privacy concern when endpoints are not clearly declared, minimized, or scoped through permissions.
agent-browser open "https://www.weather.com.cn/weather/101010100.shtml"
# 2. curl 读取 open-meteo.com
curl -s "https://api.open-meteo.com/v1/forecast?latitude=39.9042&longitude=116.4074¤t_weather=true&daily=temperature_2m_max,temperature_2m_min,weathercode&timezone=Asia%2FShanghai"
# 3. wttr.in
curl -s "wttr.in/Beijing?T"
The module-level description presents the tool exclusively as a China-weather query tool and does not offer any language or locale choice. In addition, the HTTP headers later hard-code Accept-Language: zh-CN, which reinforces a fixed locale behavior without user opt-in; this matches the language/locale policy concern for all file types.
The skill persists remotely discovered city codes into a local file without any validation beyond a regex on the code and without user consent or a trust boundary around the file. Because the persisted city name comes from network input and is written directly as CSV-like text, a compromised upstream service or manipulated response could poison future lookups, grow the file indefinitely, or inject malformed entries that affect subsequent behavior.
The module docstring states that the tool supports specifying output format as json/query, but the actual CLI only recognizes -json, -today, and -life. There is no query format switch or corresponding behavior in the code, so the documentation actively misstates implemented functionality.
No suspicious patterns detected.