{"data":{"skill":{"slug":"danielmax937-current-location-weather","name":"current-location-weather","icon":"📦","repo":"https://github.com/DanielMax937/pocker/tree/main/current-location-weather/","status":"approved","author":"DanielMax937","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"8fe5a104-e223-4d88-ac22-c0cac6f54c06","skill_id":"3924c225-7141-445b-bfec-b8ab407059e1","version":7,"content_hash":"f4de4e3e4da7ca8bc6ceb536af0620c0","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"The confirmed risk is external network access for IP-based geolocation and weather lookup. Static high-risk weak-crypto and obfuscation findings were false positives after context review, and no prompt injection attempt was found.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"scripts/get_weather.py","line_end":24,"line_start":24},{"file":"scripts/get_weather.py","line_end":62,"line_start":62},{"file":"scripts/get_weather.py","line_end":65,"line_start":65},{"file":"scripts/get_weather.py","line_end":69,"line_start":68}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":14},{"file":"SKILL.md","line_end":21,"line_start":16},{"file":"SKILL.md","line_end":23,"line_start":21},{"file":"SKILL.md","line_end":26,"line_start":23},{"file":"SKILL.md","line_end":29,"line_start":26},{"file":"SKILL.md","line_end":32,"line_start":29},{"file":"SKILL.md","line_end":35,"line_start":32},{"file":"SKILL.md","line_end":40,"line_start":35},{"file":"SKILL.md","line_end":43,"line_start":40},{"file":"SKILL.md","line_end":46,"line_start":43},{"file":"SKILL.md","line_end":64,"line_start":46},{"file":"SKILL.md","line_end":76,"line_start":64}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Automatic IP Geolocation Request","locations":[{"file":"scripts/get_weather.py","line_end":37,"line_start":21}],"confidence":0.92,"description":"The script contacts ip-api.com over plain HTTP when no location is provided. This exposes the runner's IP-derived location to a third party and allows network observers to inspect or modify the response.","confidence_reasoning":"The code directly calls http://ip-api.com/json/ before requesting weather data. The behavior is documented and legitimate, but it has clear privacy and transport-security implications."},{"title":"External Weather Service Request","locations":[{"file":"scripts/get_weather.py","line_end":69,"line_start":61}],"confidence":0.88,"description":"The script sends the selected or detected location to wttr.in. This is necessary for the skill, but users should understand that location queries leave the local environment.","confidence_reasoning":"The URLs are constructed from the location value and opened with urllib. This confirms third-party network access without showing malicious exfiltration intent."}],"low_findings":[{"title":"Documented Command Examples","locations":[{"file":"SKILL.md","line_end":34,"line_start":14}],"confidence":0.84,"description":"SKILL.md includes shell examples for running the Python script. These examples are expected usage instructions, but users should review community scripts before execution.","confidence_reasoning":"The backtick detections are Markdown code fences and example commands, not dynamic command execution inside the skill. The underlying script still requires user-authorized execution."},{"title":"Static High-Risk Pattern False Positives","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"scripts/get_weather.py","line_end":1,"line_start":1},{"file":"scripts/get_weather.py","line_end":119,"line_start":90}],"confidence":0.9,"description":"The weak cryptography and obfuscation alerts do not correspond to cryptographic calls, encoded payloads, or hidden execution logic in the reviewed lines.","confidence_reasoning":"The cited lines contain front matter, a shebang, weather field names, and argparse description settings. No weak crypto algorithm use or obfuscated code was found."}],"dangerous_patterns":[{"title":"Plain HTTP Third-Party Request","locations":[{"file":"scripts/get_weather.py","line_end":24,"line_start":24}],"confidence":0.93,"description":"The geolocation request uses HTTP instead of HTTPS. This can expose request metadata and allows response tampering on untrusted networks.","confidence_reasoning":"The URL literal starts with http:// and is passed directly to urlopen. The risk is transport security, not confirmed malicious intent."},{"title":"Hardcoded External Endpoints","locations":[{"file":"scripts/get_weather.py","line_end":24,"line_start":24},{"file":"scripts/get_weather.py","line_end":65,"line_start":62}],"confidence":0.86,"description":"The script depends on ip-api.com and wttr.in. This creates privacy and availability risks outside the user's control.","confidence_reasoning":"The endpoints are visible string literals used for the skill's core behavior. The code does not hide the destinations or send unrelated local data."}],"files_scanned":2,"total_lines":234,"audit_model":"codex","audited_at":"2026-06-29T09:53:54.114+00:00","created_at":"2026-06-29T10:07:06.677299+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}