Sun Path & Environmental Analysis

Generates a sun path diagram, calculates solar position, performs building shadow analysis, and analyzes thermal comfort.

This skill appears to do exactly what it says: local Python scripts that calculate solar geometry, shadowing, and create plots. Before installing or using it: 1) Review and run the scripts in a controlled environment (virtualenv/container) and install the requirements from requirements.txt rather than system-wide. 2) Be mindful of the SKILL.md instruction to 'execute without confirmation' — if you allow autonomous agent invocation, the agent may run the scripts immediately when asked; if you want manual control, disable autonomous invocation or require confirmation. 3) When using terrain_shadow, only pass DEM files you trust and watch memory/CPU usage (the algorithm is potentially slow for large rasters). 4) PUBLISH.md contains deployment notes and an IP address (author's example); that is documentation only and not executed by the skill — nevertheless, verify the author's identity/source if you prefer published skills from known repos. 5) If you need stricter controls, run the skill in an isolated agent or sandbox and monitor file outputs under the allowed media dirs before enabling it for broad/autonomous use.

Type: OpenClaw Skill Name: sun-path Version: 1.4.1 The skill is classified as suspicious due to the `shell:exec` permission and the agent instructions in `SKILL.md` that direct the agent to execute Python scripts with user-controlled arguments. While the scripts themselves appear to perform their stated functions (solar calculations, plotting), the direct execution of `python3 scripts/*.py` with user-provided `--output` paths (e.g., `/tmp/shadow.png`) creates a potential path for shell injection if the agent were to pass unsanitized user input directly to the shell command. The `PUBLISH.md` file also contains `rsync` and `npm` commands, which, while part of a deployment process, highlight the broad shell access available. There is no clear evidence of intentional malicious behavior like data exfiltration or persistence, but the combination of `shell:exec` and user-controlled arguments represents a significant vulnerability.