pp-weather-goat
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the weather-goat CLI using
npxfrom the@mvanhorn/printing-press-libraryNPM package andgo installfrom thegithub.com/mvanhorn/printing-press-libraryrepository. These are vendor-owned resources for this skill.\n- [COMMAND_EXECUTION]: The skill's primary functionality is achieved by executing theweather-goat-pp-cliandweather-goat-pp-mcpbinaries via the shell environment.\n- [DATA_EXFILTRATION]: The CLI tool includes a--deliver webhookflag that allows routing command output to external URLs and afeedbackfeature that can send data to a remote endpoint if theWEATHER_GOAT_FEEDBACK_ENDPOINTenvironment variable is configured.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external weather providers (Open-Meteo and NWS), creating a surface for potential indirect prompt injection attacks where malicious data could influence agent behavior.\n - Ingestion points: External weather data from Open-Meteo and National Weather Service APIs retrieved by the binary.\n
- Boundary markers: None present in the skill instructions.\n
- Capability inventory: Execution of the
weather-goat-pp-clibinary and access to theRead Bashtool.\n - Sanitization: Not explicitly described in the skill implementation details.
Audit Metadata