Open-Meteo Weather + Weather Strip

Get weather forecasts via Open-Meteo API (free, no API key). Use when: user asks about weather, temperature, rain probability, UV index, wind, or forecasts f...

This skill appears to do exactly what it claims: fetch weather from Open‑Meteo and render an SVG/HTML strip. Before installing or running: 1) Ensure you are comfortable with the skill writing output files when --output is used (check paths to avoid overwriting important files). 2) Confirm python3 and curl are available in the runtime environment. 3) If you plan to let an agent call the skill autonomously, be aware it can run the scripts and write files without further prompts — limit agent permissions or run in a sandbox if you want stricter containment. If you need extra assurance, review the included scripts line-by-line (they only call Open‑Meteo endpoints and use standard libraries).

Type: OpenClaw Skill Name: open-meteo Version: 1.0.0 The skill bundle is classified as suspicious due to several vulnerabilities. The `scripts/weather.sh` script is susceptible to shell injection, as it directly interpolates command-line arguments (e.g., latitude, longitude) into a `curl` command without sanitization, potentially allowing arbitrary command execution if the agent passes untrusted user input. Additionally, `scripts/weather_strip.py` has a potential Cross-Site Scripting (XSS) vulnerability where `loc["name"]` from the `--schedule` argument is directly embedded into the generated HTML's JavaScript data, and a potential Server-Side Request Forgery (SSRF) vulnerability due to direct interpolation of `lat`/`lon` into `urllib.request.urlopen` calls. While the skill's stated purpose is benign, these flaws could be exploited by a malicious actor controlling the agent's input.