pp-weather-goat

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the weather-goat CLI using npx from the @mvanhorn/printing-press-library NPM package and go install from the github.com/mvanhorn/printing-press-library repository. These are vendor-owned resources for this skill.\n- [COMMAND_EXECUTION]: The skill's primary functionality is achieved by executing the weather-goat-pp-cli and weather-goat-pp-mcp binaries via the shell environment.\n- [DATA_EXFILTRATION]: The CLI tool includes a --deliver webhook flag that allows routing command output to external URLs and a feedback feature that can send data to a remote endpoint if the WEATHER_GOAT_FEEDBACK_ENDPOINT environment variable is configured.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external weather providers (Open-Meteo and NWS), creating a surface for potential indirect prompt injection attacks where malicious data could influence agent behavior.\n
  • Ingestion points: External weather data from Open-Meteo and National Weather Service APIs retrieved by the binary.\n
  • Boundary markers: None present in the skill instructions.\n
  • Capability inventory: Execution of the weather-goat-pp-cli binary and access to the Read Bash tool.\n
  • Sanitization: Not explicitly described in the skill implementation details.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 08:05 AM