数联互通weather

Get current weather and forecasts via WeatherAPI.com. Use when: user asks about weather, temperature, or forecasts for any location. IMPORTANT: You must conf...

This skill appears coherent and low-risk: it simply issues HTTPS requests to api.weatherapi.com using your WEATHER_API_KEY via curl. Before installing, (1) ensure you obtain the API key from the official WeatherAPI site and store it securely (avoid adding long-lived keys to shared shell rc files if the machine is multi-user), (2) confirm you’re comfortable with outbound requests to WeatherAPI (requests include the location strings you query), and (3) verify curl is an acceptable dependency on your system. Because this is instruction-only (no code bundled), the main risk is accidental leakage of the API key—prefer configuring it in the OpenClaw UI or a secure secret store rather than a world-readable file.

Type: OpenClaw Skill Name: shulian-weather Version: 1.0.0 The skill's primary function is benign, providing weather information via WeatherAPI.com. However, the `SKILL.md` file defines `curl` commands that dynamically incorporate user input (e.g., location for `q=London`). If the OpenClaw agent does not properly sanitize this user input before executing the shell commands, it could lead to shell injection, allowing an attacker to execute arbitrary commands on the host system. This represents a significant vulnerability (potential RCE) but does not show clear evidence of intentional malicious behavior by the skill author, thus classifying it as suspicious.