weather

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches weather data from wttr.in and api.open-meteo.com. These are well-known public services for weather information. It also suggests installing jq via Homebrew, a standard package manager, to parse JSON responses.
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to run curl and jq commands. This is a standard and expected method for interacting with web-based APIs in a development environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (the weather APIs) which could theoretically contain malicious instructions if the source were compromised.
  • Ingestion points: API responses from wttr.in and api.open-meteo.com are loaded into the agent's context (SKILL.md).
  • Boundary markers: None explicitly defined in the instructions for separating API data from instructions.
  • Capability inventory: Uses Bash for curl and jq operations (SKILL.md).
  • Sanitization: City names are URL-encoded (replacing spaces with +) before being passed to shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 02:13 AM