weather-hardened
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates access to weather information from public, no-auth-required services (wttr.in and Open-Meteo).
- [SAFE]: The skill incorporates explicit "Security Guardrails" instructing the AI agent to refuse malicious requests involving SSRF, exfiltration, or secret embedding.
- [SAFE]: The SAFETY.md file acts as technical documentation for the vendor's security testing. While it contains examples of dangerous commands (e.g., SSRF bypasses), they are clearly identified as failure cases for testing purposes and are not part of the operational instructions.
- [DATA_EXFILTRATION]: The skill uses curl for data retrieval. Its security guidelines explicitly prohibit using curl with flags or piping that could enable data exfiltration or expose sensitive environment variables.
- [PROMPT_INJECTION]: The skill documents the potential risk of processing data from external endpoints (Indirect Prompt Injection surface). • Ingestion points: Weather API responses from wttr.in and api.open-meteo.com (SKILL.md). • Boundary markers: Relies on negative instruction guardrails to prevent the agent from obeying instructions embedded in data. • Capability inventory: Uses curl for network requests and can write output to /tmp/ (SKILL.md). • Sanitization: Guidelines instruct the agent to avoid arbitrary or user-provided geocoding URLs and services.
Audit Metadata