Weather-Webcam-V2

Fetches current weather from Open-Meteo API and automatically captures a live webcam image from Meteoblue or Windy for the requested location. Use it when th...

This skill appears to do what it advertises: call Open‑Meteo, browse public webcam pages, extract an image, and return it. Before installing, consider: (1) agent-browser will execute JavaScript on arbitrary third‑party pages — that is required to click cookie dialogs and extract images but means the skill can interact with pages you navigate to; (2) the SKILL.md relies on an absolute agent-browser binary path which may differ on your system; (3) the metadata files show a small slug/version mismatch (nonfunctional but worth noting). If you’re comfortable letting the agent use agent-browser to visit external sites and download images, the permissions requested are proportional. If you need stricter controls, avoid enabling web‑browsing skills or review/modify the instructions to restrict which domains may be visited.

Type: OpenClaw Skill Name: weather-webcam-v2 Version: 1.0.0 The skill is classified as suspicious due to a critical shell injection vulnerability in SKILL.md. The `curl` commands directly embed the `[Location]` variable without apparent sanitization, allowing an attacker to inject arbitrary shell commands. Additionally, the skill performs web searches and navigates `agent-browser` to potentially user-controlled URLs, which could lead to client-side attacks or the download of malicious files disguised as images, further increasing the risk profile. There is no clear evidence of intentional malicious behavior like data exfiltration or persistence, but the vulnerabilities are severe.