Weather Intelligence Digest Fresh

Generate daily Weather Intelligence Digest using NOAA/NWS data with customizable locations and alert monitoring.

This skill appears to do exactly what it claims: fetch public NOAA/NWS data and render a digest. Before installing: (1) review the full weather_digest.py file (the provided snippet is benign but one truncated portion remains in the bundle); (2) run it inside a Python virtualenv and inspect/lock requirements (requests>=2.31.0); (3) confirm it only contacts api.weather.gov (the code sets the User-Agent and uses that domain); (4) respect NOAA API usage/rate limits and set an appropriate User-Agent; (5) avoid running as a privileged user and do not store sensitive credentials in config.json. If you plan to schedule it or expose outputs, verify the output handling (email/publishing) code or automation recipes you attach do not send data to unexpected third parties.

Type: OpenClaw Skill Name: weather-intelligence-digest-fresh Version: 1.0.0 The skill's core functionality is benign, fetching weather data from api.weather.gov. However, it is classified as suspicious due to vulnerabilities related to arbitrary file read/write and potential output injection. The `weather_digest.py` script accepts `--config`, `--output`, `--html`, and `--json` arguments, which could allow an attacker to read or write to arbitrary file paths if an AI agent were to execute the skill with untrusted input. Additionally, user-controlled input from `config.json` (e.g., location `name`) and external API data (alert headlines/instructions) are embedded into the generated Markdown and HTML without sufficient sanitization, posing a risk for XSS or Markdown injection if the input or API response were malicious.