Weather NWS

US weather forecasts via National Weather Service (NWS) with automatic fallback to global weather for non-US locations. Provides detailed accumulation data,...

This skill appears to do what it says: it geocodes the user-provided location, calls NWS for US locations, falls back to wttr.in for others, and optionally queries AirNow when you supply AIRNOW_API_KEY. Before installing or running: 1) review the full scripts/get_weather.py file (the prompt contained a truncated excerpt) to confirm there are no hidden endpoints or obfuscated code; 2) be aware the script will send location strings to external services (Nominatim, api.weather.gov, wttr.in, and optionally AirNow) — if you need to keep location queries private, avoid running the script or run it in an environment you control; 3) supply only the optional AIRNOW_API_KEY if you trust the skill and the platform; 4) watch for rate limits and respect Nominatim/NWS usage policies (the code already sets a User-Agent). If you want, I can re-check the complete get_weather.py file line-by-line for any hidden behavior.

Type: OpenClaw Skill Name: weather-nws Version: 1.0.3 The skill's `SKILL.md` is benign and does not contain any prompt injection attempts or malicious instructions. The `scripts/get_weather.py` script implements the described weather functionality, making legitimate network calls to external weather services (NWS, AirNow, wttr.in). However, the `geocode_location` function in `scripts/get_weather.py` constructs a URL to `nominatim.openstreetmap.org` using user-provided `location` input. Although `urllib.parse.quote` is used, this pattern of using `urllib.request.urlopen` with user-influenced URL parameters can introduce a theoretical Server-Side Request Forgery (SSRF) vulnerability, allowing an attacker to potentially probe internal network resources. This constitutes a vulnerability, classifying the skill as suspicious rather than malicious due to the lack of clear intentional harmful behavior.