weather-now
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
curlcommand to interact with web-based weather services. This is a standard and expected method for retrieving real-time weather data. - [EXTERNAL_DOWNLOADS]: Retrieves weather data from well-known public services including
wttr.inandopen-meteo.com. These services are used according to their intended purpose for providing weather updates. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external APIs, creating a potential surface for indirect prompt injection. This is an inherent risk when an agent fetches untrusted data; however, the risk is mitigated in this skill by using reputable data sources and providing instructions for the agent to interpret data into a specific, human-readable format rather than executing it.
- Ingestion points: External weather data from
wttr.inandapi.open-meteo.com(SKILL.md) - Boundary markers: Absent; the skill relies on the agent's interpretation of the weather data.
- Capability inventory: Use of
curlfor network requests (SKILL.md) - Sanitization: Instructions suggest translating data into words/sentences, which acts as a form of content filtering.
Audit Metadata