open-meteo
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill utilizes the httpx library to perform network GET requests to Open-Meteo's official domains (open-meteo.com) for weather and geocoding data. This is documented as a standard functionality of the skill for retrieving weather information.
- [INDIRECT_PROMPT_INJECTION]: The skill integrates external data from API responses, creating a surface for potential indirect prompt injection where data from the weather service could influence agent behavior. \n- Ingestion points: JSON results from the Forecast, Air Quality, and Geocoding APIs as referenced in references/examples.py and references/examples.md. \n- Boundary markers: None; the instructions do not specify the use of delimiters or 'ignore' instructions for the external data. \n- Capability inventory: The skill is limited to outbound network requests via httpx and does not have access to sensitive local files, credentials, or arbitrary shell command execution. \n- Sanitization: Standard URL encoding is performed by the httpx client for all API request parameters.
Audit Metadata