fittings-weather
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run a local script 'scripts/call.mjs' using Node.js to perform data lookups and service descriptions. The source code for this script was not included in the analyzed file.\n- [EXTERNAL_DOWNLOADS]: The skill interacts with 'https://fittings.sh' to fetch catalog data and execute weather service calls. This is a vendor-owned domain used for the skill's primary functionality.\n- [PROMPT_INJECTION]: The skill processes data from various external official sources such as the National Weather Service, NASA, and NOAA, which represents a surface for indirect prompt injection.\n
- Ingestion points: External weather and hazard data enters the agent context through the output of the 'call.mjs' script.\n
- Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the external data feeds.\n
- Capability inventory: The agent can execute local shell commands and access network resources via the provided script.\n
- Sanitization: No specific sanitization, validation, or escaping logic is described in the skill documentation for the ingested data.
Audit Metadata