weather
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
curlto retrieve data from well-known public weather services atwttr.inandapi.open-meteo.com. - [COMMAND_EXECUTION]: The skill provides examples of
curlcommands to display weather in the terminal and one example that writes a PNG file to the/tmpdirectory. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it ingests data from external sources.
- Ingestion points: Data enters the context via
curlrequests towttr.inandopen-meteo.comas described inSKILL.md. - Boundary markers: The instructions do not define specific delimiters or warnings for the agent when processing the API responses.
- Capability inventory: The skill uses
curlfor network requests and file writing to the/tmppath. - Sanitization: There is no evidence of filtering or validation of the content returned by the external APIs.
Audit Metadata