No prompt injection, obfuscation, or command-execution abuse was found; the code-fence and obfuscation alerts are false positives. The skill intentionally makes outbound requests to ip-api.com and wttr.in, including automatic IP geolocation over plaintext HTTP, so the remaining concerns are privacy and network-integrity risks.
When no location is provided, the script contacts ip-api.com to infer location from the caller IP before weather lookup. This behavior is disclosed, but it lacks an explicit consent step before sharing approximate location with a third-party service.
The code path calls ip-api.com automatically when location is absent, and the documentation states that IP-based location detection is used. The risk is privacy exposure rather than hidden malware.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
with urllib.request.urlopen("http://ip-api.com/json/", timeout=10) as response:
The hardcoded ip-api.com endpoint uses plaintext HTTP for geolocation. That can expose the request path to network observers and allows response tampering in transit.
with urllib.request.urlopen("http://ip-api.com/json/", timeout=10) as response:
The code performs an outbound request to ip-api.com to infer location from the caller IP. This exposes IP-derived location data to a third-party service.
The Request object prepares an outbound call to wttr.in using the requested or detected location. This is intended behavior, but it still shares location context with an external service.
No prompt injection, obfuscation, or command-execution abuse was found; the code-fence and obfuscation alerts are false positives. The skill intentionally makes outbound requests to ip-api.com and wttr.in, including automatic IP geolocation over plaintext HTTP, so the remaining concerns are privacy and network-integrity risks.
When no location is provided, the script contacts ip-api.com to infer location from the caller IP before weather lookup. This behavior is disclosed, but it lacks an explicit consent step before sharing approximate location with a third-party service.
The code path calls ip-api.com automatically when location is absent, and the documentation states that IP-based location detection is used. The risk is privacy exposure rather than hidden malware.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
with urllib.request.urlopen("http://ip-api.com/json/", timeout=10) as response:
The hardcoded ip-api.com endpoint uses plaintext HTTP for geolocation. That can expose the request path to network observers and allows response tampering in transit.
with urllib.request.urlopen("http://ip-api.com/json/", timeout=10) as response:
The code performs an outbound request to ip-api.com to infer location from the caller IP. This exposes IP-derived location data to a third-party service.
The Request object prepares an outbound call to wttr.in using the requested or detected location. This is intended behavior, but it still shares location context with an external service.
The confirmed risk is external network access for IP-based geolocation and weather lookup. Static high-risk weak-crypto and obfuscation findings were false positives after context review, and no prompt injection attempt was found.
2
Files scanned
234
Lines analyzed
5
Review items
1
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The script contacts ip-api.com over plain HTTP when no location is provided. This exposes the runner's IP-derived location to a third party and allows network observers to inspect or modify the response.
The code directly calls http://ip-api.com/json/ before requesting weather data. The behavior is documented and legitimate, but it has clear privacy and transport-security implications.
The script sends the selected or detected location to wttr.in. This is necessary for the skill, but users should understand that location queries leave the local environment.
The URLs are constructed from the location value and opened with urllib. This confirms third-party network access without showing malicious exfiltration intent.
SKILL.md includes shell examples for running the Python script. These examples are expected usage instructions, but users should review community scripts before execution.
The backtick detections are Markdown code fences and example commands, not dynamic command execution inside the skill. The underlying script still requires user-authorized execution.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
The weak cryptography and obfuscation alerts do not correspond to cryptographic calls, encoded payloads, or hidden execution logic in the reviewed lines.
The cited lines contain front matter, a shebang, weather field names, and argparse description settings. No weak crypto algorithm use or obfuscated code was found.
This skill makes legitimate network requests to public weather APIs (ip-api.com and wttr.in) for geolocation and weather data. All static findings for weak cryptography and command execution are false positives caused by documentation examples in markdown backticks and JSON field names. The Python script uses only standard library functions with proper error handling and no user input injection risks.
3
Files scanned
651
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The IP geolocation service uses HTTP instead of HTTPS (line 24). While this is a read-only public API with no sensitive data transmission, HTTPS would be preferred. The weather API correctly uses HTTPS.
A straightforward weather fetching script using Python standard library. Makes documented HTTP requests to public weather APIs (ip-api.com and wttr.in) to retrieve weather data. No file access, no environment variables, no external commands.
A straightforward weather fetching script using Python standard library. Makes documented HTTP requests to public weather APIs (ip-api.com and wttr.in) to retrieve weather data. No file access, no environment variables, no external commands.
A straightforward weather fetching script using Python standard library. Makes documented HTTP requests to public weather APIs (ip-api.com and wttr.in) to retrieve weather data. No file access, no environment variables, no external commands.