weather

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill fetches weather information from public APIs (wttr.in and Open-Meteo) based on user-supplied city names, which are third-party web services rather than unauthenticated outsider-authored submission channels like support tickets or public comment feeds.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs the agent to fetch operational weather data and command output at runtime using curl from public services (wttr.in and api.open-meteo.com) under common/reputable unofficial provenance, constituting a medium-tier operational dependency.