connector-weatherapi
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from WeatherAPI.com. This creates a surface where an attacker could theoretically inject instructions into the agent's context through weather data fields (e.g., location names or weather descriptions).
- Ingestion points: SKILL.md (via weatherapi-client calls to api.weatherapi.com).
- Boundary markers: None present in the code snippets.
- Capability inventory: The skill is limited to reading data via GET requests; it does not contain shell execution or file write capabilities.
- Sanitization: Not explicitly implemented in the example snippets.
- [EXTERNAL_DOWNLOADS]: The skill depends on the weatherapi-client package managed by mops. This is a legitimate dependency for the Motoko development environment.
Audit Metadata