weather
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches weather data from
wttr.inandapi.open-meteo.com. These are well-known public services for weather information. It also suggests installingjqvia Homebrew, a standard package manager, to parse JSON responses. - [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to runcurlandjqcommands. This is a standard and expected method for interacting with web-based APIs in a development environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (the weather APIs) which could theoretically contain malicious instructions if the source were compromised.
- Ingestion points: API responses from
wttr.inandapi.open-meteo.comare loaded into the agent's context (SKILL.md). - Boundary markers: None explicitly defined in the instructions for separating API data from instructions.
- Capability inventory: Uses
Bashforcurlandjqoperations (SKILL.md). - Sanitization: City names are URL-encoded (replacing spaces with
+) before being passed to shell commands.
Audit Metadata