Weather Outfit Advisor

Query weather and provide outfit recommendations. When information is insufficient, ask about destination, date, and clothing preferences. Uses free weather...

This skill appears to implement the advertised functionality, but exercise caution before installing or using it as-is: - The repository embeds a Pexels API key in cleartext. That key is related to the skill's image feature, so it's expected for functionality, but hardcoded credentials are risky: the key may belong to someone else, could be rate-limited, revoked, or used to track requests. Prefer replacing it with your own API key provided via a secure environment variable, or remove the image feature. - The scripts make outbound HTTP requests (wttr.in, Pexels API, and fallbacks to Bing results). User-provided location/date will be transmitted to those external services — consider privacy implications for sensitive locations or dates. - No install script runs, but the skill executes bundled Python scripts via subprocess. The code uses list-style subprocess invocation (not a shell), which is safer, but still validate inputs if you plan to run on sensitive infrastructure. - If you want to use this skill: ask the publisher for provenance (homepage/owner details), replace the embedded API key with your own stored in an environment variable, and verify the key's permissions and limits. If you cannot verify the embedded key's origin, avoid using the image-search feature or remove the key before use. I have moderate confidence in this assessment. Additional useful information that would raise confidence: verification of the Pexels API key owner, confirmation that no other hidden endpoints exist, or an updated version that accepts API keys via env vars instead of hardcoding.

Type: OpenClaw Skill Name: weather-outfit-advisor Version: 1.0.1 The skill bundle is a functional weather and outfit recommendation tool that aligns with its stated purpose. It uses standard Python libraries to query weather data from wttr.in and fetch fashion images from the Pexels API. While it contains a hardcoded Pexels API key in 'scripts/search_images.py' (a credential leak vulnerability for the developer), there is no evidence of malicious intent, data exfiltration, or harmful prompt injection targeting the user or the agent environment.