Türkiye AFAD Deprem

Turkiye AFAD deprem verisini kullanarak zaman, buyukluk ve bolge filtreli deprem ozeti uretir.

This skill appears coherent and limited in scope: it only issues GET requests to the AFAD API, filters results, and formats a summary. Before installing, confirm you are comfortable with the agent having outbound network access (the skill needs network to call AFAD). Note that the script accepts a --source-url override — if you or a calling component supply a different URL it could fetch from another server, so avoid pointing it at untrusted endpoints. If you need stronger isolation, run the script in a restricted environment or review the code locally before enabling autonomous invocation.

Type: OpenClaw Skill Name: turkiye-afad-deprem Version: 0.1.0 The skill's stated purpose is benign, focusing on fetching and filtering public AFAD earthquake data. The `SKILL.md` explicitly disclaims malicious actions. However, the `scripts/fetch_afad_earthquakes.py` script includes command-line arguments `--source-url` and `--fixture`. These arguments introduce vulnerabilities: `--source-url` could be abused for Server-Side Request Forgery (SSRF) if an attacker can control the URL, and `--fixture` could lead to local file disclosure by reading arbitrary file paths. While these are not inherently malicious code, they represent significant attack surfaces if the AI agent is susceptible to prompt injection, making the skill 'suspicious' due to these exploitable capabilities.