Swiss-Weather

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Swiss weather helper that fetches public MeteoSwiss data, with only minor dependency-hardening guidance.

Install only in an isolated Python environment, prefer pinning `requests` before use, and expect the scripts to make outbound requests to MeteoSwiss/public Swiss weather endpoints when you ask for weather data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:154

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 154–158
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code

markdown

## Dependencies

```bash
pip3 install requests

text

The same unpinned installation requirement is also referenced at line 29:

```markdown
**Option 2: Python script (requires: pip3 install requests)**

Technical Analysis

The documented installation command retrieves the currently available version of requests and its transitive dependencies from the user's configured Python package index. The project provides no version constraint, lock file, package hashes, or index restriction.

Consequently, the dependency graph may change after this Skill has been audited. If a future package release, transitive dependency, or configured package repository is compromised, following the documented command could install attacker-controlled code. This is a supply-chain hardening weakness; the audit found no evidence that the current requests package is malicious.

Attack Path

1. An attacker compromises a future release of requests, one of its transitive dependencies, or a Python package index configured on the victim's system.
2. A user follows the documented pip3 install requests instruction.
3. Pip resolves and downloads the mutable dependency set without validating project-supplied hashes.
4. The compromised package is installed in the selected Python environment.
5. Attacker-controlled code may run during package installation or when scripts/current_weather.py or scripts/forecast.py imports the dependency.

Impact Assessment

Successful exploitation could execute code with the privileges of the user running pip or invoking the weather scripts. The potential scope includes files, credentials, environment variables, and network resources accessible to that user. The impact would be greater if installation is performed in a privileged environment, although the pro ...[truncated 48 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed dependency file that pins requests and every transitive dependency to exact versions.
2. Generate and record cryptographic hashes for all approved distributions.
3. Replace the installation instruction with a hash-enforcing command, for example:

bash

python3 -m pip install --require-hashes -r requirements.txt

4. Regularly review and update pinned dependencies using automated vulnerability and provenance checks.
5. Use an explicitly trusted package index in controlled deployments.
6. Consider replacing requests with Python's standard-library HTTP client to eliminate this external runtime dependency.
7. Recommend installation in an isolated virtual environment and explicitly discourage privileged installation.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill documentation instructs users to run shell and Python scripts that make external network requests, but the skill declares no permissions for shell or network access. This creates a capability/permission mismatch that can bypass user expectations and security review, especially because executing local scripts with network access expands the attack surface beyond a purely informational skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.