weather-cn-pro

中国天气网增强版 - 查询中国城市的实时天气、逐小时预报、7天预报和生活指数。 相比基础版增加：逐小时预报、7天预报、更好的格式化输出。 作者: Jeremy

This skill appears to be a straightforward shell scraper for weather.com.cn and requires only curl/grep, which is consistent with its purpose. However, the script also queries a third‑party AQI service (api.aooi.com) that is not mentioned in the SKILL.md. Before installing or running it, consider: (1) review or remove the get_aqi() call if you don't want your queries (the city name and your IP) sent to a third party; (2) run the script in an environment with limited network access if you want to observe behavior safely; (3) because the source and homepage are unknown, be cautious about trusting future versions — prefer code from a known repository or author; (4) the scraping approach is brittle (may break if the website changes) but not inherently malicious. If you need higher assurance, ask the author to document external endpoints and their purpose or provide a signed/hosted source repository. Additional information that would raise confidence: a documented homepage/repository, an explicit mention in SKILL.md of the AQI provider, or confirmation that no other external endpoints are used.

Type: OpenClaw Skill Name: weather-cn-pro Version: 1.0.0 The script `weather-cn-pro.sh` contains a potential command injection vulnerability by using `eval` on data parsed from an external website (weather.com.cn). While the current regex-based extraction provides some sanitization, using `eval` on remote content is a high-risk practice. Additionally, the script makes an unauthenticated request to a third-party API (`api.aooi.com`) for AQI data, which is an external dependency not explicitly mentioned in the primary description.