weather-cn-fixed

中文天气查询工具 - 使用中国天气网获取实时天气（无需API密钥，不依赖大模型）

This skill is internally consistent and appears to implement a lightweight scraper for weather.com.cn. Before installing, consider: 1) scraping fragility — the script parses HTML with grep/sed and may break if the site structure changes; 2) rate limits and terms-of-service — frequent automated requests could violate the site’s rules; 3) execution risk — it includes an executable shell script, so inspect the file (already reviewed) or run in a sandbox if you don't trust the source; 4) network access — the skill requires outbound access to www.weather.com.cn; restrict network permissions if possible. No secrets are requested and there are no remote install URLs, so the immediate security footprint is small.

Type: OpenClaw Skill Name: weather-cn-fixed Version: 1.0.2 The weather-cn.sh script contains a shell injection vulnerability due to the use of 'eval' on unsanitized data parsed from an external website (weather.com.cn). Specifically, the script extracts content from HTML tags like <title> and passes it directly into an eval statement in the format_output function, which could allow arbitrary command execution if the fetched content is manipulated or the site is compromised. While the script's purpose is legitimate weather retrieval, the lack of input sanitization poses a significant security risk.