Pollen Forecast 花粉播报

Daily pollen forecast and allergy alerts for Chinese cities. Use when user asks about pollen levels, allergy season, hay fever, flower pollen, 花粉, 过敏, or wan...

This instruction-only skill appears coherent and low-risk, but before enabling automatic alerts: (1) confirm the agent/platform has a safe, intended target for --channel / --to and that announcement permissions are correct; (2) verify the 'web_search' tool is available and that scheduled searches won't leak sensitive context; (3) if you use the example model (openrouter/...), understand that requests may be routed to that provider — check privacy/PII handling; (4) test the report manually once before adding the cron job to avoid accidental mass announcements.

Type: OpenClaw Skill Name: pollen-forecast Version: 1.0.0 The skill is designed for a benign purpose (pollen forecasts). However, the `SKILL.md` file includes instructions for setting up daily alerts using `openclaw cron add`. The `--message` parameter for this cron job contains a `{city}` placeholder. If the OpenClaw agent does not properly sanitize or escape user input when filling this placeholder, a malicious user could potentially inject arbitrary instructions into the scheduled prompt, leading to prompt injection against the agent. This represents a vulnerability rather than direct malicious intent from the skill author, classifying it as suspicious.