此报告尚无所请求语言的翻译，当前显示规范英文报告。

版本化安全评估

报告编号: SA-7E9E368D

7/5/2026, 10:02:25 AM

current-location-weather 安全评估 v9

Skill 安全认证报告

审计历史
审计模型: codex 最新发布的报告
技能名称
current-location-weather
版本
v9
维护者
DanielMax937
来源
github.com/DanielMax937/pocker/tree/main/current-location-weather/
覆盖范围
2 已扫描文件 · 234 分析行数
策略版本
不可用

已确认问题的最高严重性

中

有 1 个已确认的安全问题需要处理。

安装上下文

请查看当前 Skill 详情页

本页仅汇总报告证据。Skill 详情页提供 canonical install advisory。

打开当前 Skill 详情页

本报告不会阻止或授权 manifest 或 ZIP。

No prompt injection, obfuscation, or command-execution abuse was found; the code-fence and obfuscation alerts are false positives. The skill intentionally makes outbound requests to ip-api.com and wttr.in, including automatic IP geolocation over plaintext HTTP, so the remaining concerns are privacy and network-integrity risks.

报告位置

最新发布的报告

“最新”仅指报告序列，不代表 artifact 当前有效。

审计证明

无法签发证明

所需的不可变绑定不完整。

人工验证

未进行人工验证

本报告没有人工验证记录。

覆盖范围

2 已扫描文件 · 234 分析行数

有 7 项内容需要查看

局限

本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。

证据链

证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。

  1. 来源

    已绑定 commit 与路径

  2. 构件

    已绑定内容与 tree hash

  3. 审计

    已完成

  4. 安装契约

    打开 manifest 进行验证

    打开 manifest

观察到的能力

“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。

包含脚本

可能执行 Skill 随附的代码。

本次审计未记录

网络访问

可能连接外部服务。

在 6 个证据位置观察到

文件系统访问

可能读取或写入本地文件。

本次审计未记录

环境变量

可能读取进程环境中的值。

本次审计未记录

外部命令

可能调用 Skill 之外的命令或程序。

在 12 个证据位置观察到

能力复核项 (6)
中
scripts/get_weather.py:24
Hardcoded URL
with urllib.request.urlopen("http://ip-api.com/json/", timeout=10) as response:
The hardcoded ip-api.com endpoint uses plaintext HTTP for geolocation. That can expose the request path to network observers and allows response tampering in transit.
低
scripts/get_weather.py:24
Python HTTP libraries
with urllib.request.urlopen("http://ip-api.com/json/", timeout=10) as response:
The code performs an outbound request to ip-api.com to infer location from the caller IP. This exposes IP-derived location data to a third-party service.
低
scripts/get_weather.py:68
Python HTTP libraries
req = urllib.request.Request(url, headers={"User-Agent": "curl/7.68.0"})
The Request object prepares an outbound call to wttr.in using the requested or detected location. This is intended behavior, but it still shares location context with an external service.
低
scripts/get_weather.py:69
Python HTTP libraries
with urllib.request.urlopen(req, timeout=15) as response:
The urlopen call sends the weather request to wttr.in. The endpoint is part of the skill function, but it is real external network access.
低
scripts/get_weather.py:62
Hardcoded URL
url = f"https://wttr.in/{encoded_location}?format=j1"
The hardcoded wttr.in JSON endpoint is an intended weather provider. It is still an external dependency that receives the requested location.
低
scripts/get_weather.py:65
Hardcoded URL
url = f"https://wttr.in/{encoded_location}?format=%l:+%c+%t+%h+%w"
The hardcoded wttr.in text endpoint is an intended weather provider. It creates a real third-party network request with location context.

风险问题

已确认的安全问题与仍需审核的项目分开展示。

已确认安全问题 (1)

RISK-001 中
scripts/get_weather.py:21-37SKILL.md:68-75
Automatic IP Geolocation Privacy Exposure
When no location is provided, the script contacts ip-api.com to infer location from the caller IP before weather lookup. This behavior is disclosed, but it lacks an explicit consent step before sharing approximate location with a third-party service.
The code path calls ip-api.com automatically when location is absent, and the documentation states that IP-based location detection is used. The risk is privacy exposure rather than hidden malware.

补救措施

本次审计记录了建议的修复措施。实施这些措施是维护者的责任。

  1. FIX-001
    中
    Automatic IP geolocation sends location context to a third-party service.
    Ask for explicit user confirmation before IP-based lookup, prefer user-supplied locations, and document that ip-api.com receives IP-derived location data.
  2. FIX-002
    中
    The geolocation request uses plaintext HTTP.
    Use an HTTPS geolocation provider or remove automatic geolocation if the chosen provider cannot support encrypted requests.
  3. FIX-003
    低
    Weather lookups depend on a hardcoded third-party service.
    Document wttr.in as the weather provider and explain that requested locations are sent to that service.

专家证据

不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。

Artifact 主体

Marketplace 提交
7e9e368dc1a370f2040369ebcd0db06d90cb48e5
内容哈希
432974d1b4553bce4f1a8f04f4a9e7d83282ac4068adbc77abca6049be503b35
目录树哈希
f5dbaa2f1e27c306c1cb02c40b7545f14c4aa64e6a17b92fc6663bb3e3bebadb
Skill 路径
skills/danielmax937/current-location-weather
审计载荷哈希
a432f8fedaaea965e60f549fa73e9688

分析元数据

审计模型: codex

分析状态: 已完成

范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。

验证与导出

JSON 报告 CITATION.cff SARIF 2.1.0 已签名安装清单 来源

manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。

审计证明: not_attestable