sorted-travel-weather
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill connects to an external weather service at
https://sorted.travel/mcpto fetch destination climate and forecast data. This communication is the core functionality of the skill and does not involve unauthorized data access or sensitive information exfiltration. - [INDIRECT_PROMPT_INJECTION]: The skill processes weather data from an external API, which represents a theoretical attack surface for indirect prompt injection.
- Ingestion points: External weather reports are retrieved via the
get_destination_weathertool and incorporated into the agent's context. - Boundary markers: The instructions do not define specific delimiters or instructions to ignore potential commands embedded in the weather data.
- Capability inventory: The skill has no capabilities to write to the file system, execute shell commands, or perform sensitive network operations beyond its own API communication.
- Sanitization: There are no explicit sanitization or filtering steps for the incoming API data.
Audit Metadata