weather
Warn
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructions perform a file read on
~/.gooseworks/credentials.jsonto extract an API key and base URL. - [DATA_EXFILTRATION]: The instructions state 'All endpoints use Bearer auth: -H "Authorization: Bearer $GOOSEWORKS_API_KEY"'. While the skill utilizes third-party services like
wttr.inandopen-meteo.com, following this instruction would result in leaking the vendor-specific API key to these external servers. - [COMMAND_EXECUTION]: Employs
python3 -cinline scripts to parse JSON configuration from the local filesystem. - [EXTERNAL_DOWNLOADS]: Mentions the use of
npx gooseworks login, which facilitates the download and execution of packages from a remote registry.
Audit Metadata