check-weather-forecast

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's scripts/main.py fetches live JSON from the public wttr.in URL (https://wttr.in/{city}?format=j1&lang=zh), parses and uses those fields in its runtime output, so untrusted third-party content is ingested and can influence the agent's responses.