Table Mountain Status

Fetch and report the Table Mountain Aerial Cableway status via the official weather API. Use when Master asks for “Tafelberg” updates, needs alerts about openings/closures, or wants automated Telegram reports about status, weather, and waiting times.

This skill appears to do exactly what it says: fetch a JSON status from a Table Mountain API and write a human-readable or JSON summary. Things to check before installing: 1) confirm you are comfortable the agent will access the network (the script calls a live URL) and that hitting the API at the shown path is permitted; 2) ensure you want periodic cron jobs writing files to data/table-mountain and decide on retention/permissions for those files; 3) if you plan to use the SKILL.md's Telegram example, verify your agent's Telegram integration is configured securely (this skill does not provide or request Telegram credentials); 4) if you have strict egress controls confirm the domain cms.tablemountain.net is allowed. If any of those are concerns, review or modify the script/cron schedule before enabling automated runs.

Type: OpenClaw Skill Name: table-mountain-status Version: 1.0.0 The skill's stated purpose and the instructions in SKILL.md are benign, focusing on fetching and reporting Table Mountain status. However, the `scripts/fetch_status.py` script exposes command-line arguments (`--url` and `--output`) that allow fetching data from arbitrary URLs (Server-Side Request Forgery risk) and writing data to arbitrary file paths. While the provided SKILL.md does not exploit these, the underlying script's design creates a vulnerability that could be leveraged by a malicious prompt injection against the agent, allowing it to perform unauthorized network requests or file system modifications.