ThermikBuddy

Segelflug- und Thermikvorhersage mit Thermik-Score (0-10). Nutze diesen Skill wenn der User nach Segelflugwetter, Thermik, Streckenflugbedingungen, Flugwette...

This skill mostly looks like what it says: a Python-based Thermik forecast engine that fetches Open‑Meteo data and (optionally) scrapes DHV text to adjust scores. Before installing or running it: 1) Ensure you or the environment provides python3 on PATH (SKILL.md expects 'python3' but the skill declares no required binaries). 2) Review the included .py files yourself (they are present in the bundle) — they perform outbound network calls to api.open-meteo.com and https://www.dhv.de and emit JSON; there is no credential exfiltration, but code execution is required. 3) Note the metadata/version inconsistencies (SKILL.md v2.0.0 vs _meta/origin showing 1.0.2/1.0.3) — ask the publisher which version is authoritative. 4) If you will run this in an automated agent, run it first in a sandbox or restricted environment and check its network activity. 5) If you depend on accuracy for flight decisions, treat this as advisory and cross-check with official sources (DWD, DHV, SkySight) as suggested by the skill.

Type: OpenClaw Skill Name: thermikbuddy Version: 1.0.3 The skill is classified as suspicious due to a potential shell injection vulnerability. The `SKILL.md` file instructs the OpenClaw agent to execute local Python scripts with user-provided arguments (e.g., `--name <user_input>`). If the agent's runtime environment does not properly sanitize or quote these user inputs before passing them to the shell, an attacker could inject arbitrary shell commands. While the Python scripts themselves use `argparse` safely, the instruction template in `SKILL.md` exposes this critical vulnerability in the agent's execution model. There is no evidence of intentional malicious behavior like data exfiltration or persistence within the skill's code, which otherwise performs legitimate weather forecasting by fetching data from `api.open-meteo.com` and `dhv.de`.