Walter Info

获取全球五大洲主要城市天气预报与跨境电商热点资讯，并生成格式化Markdown文档和JSON数据文件。当用户需要查询天气、跨境电商资讯，或要求生成报告时触发。

Before installing or running this skill, consider the following: - Review and edit hardcoded paths: several scripts use a fixed Windows path (C:\Users\beyon\...\.openclaw\...). If that path exists on your machine the skill will read/write/delete files there. Change those paths to safe, relative locations before running, or run in an isolated/sandbox environment. - Audit deletion behavior: cleanup.py will remove config.example.json in the hardcoded path; apply_llm_summaries.py deletes llm_input_*.json. Ensure those files are not needed or backed up. - Network security risk: fetch_news.py's HTTP helper disables SSL certificate verification (ssl.CERT_NONE). That makes requests vulnerable to MITM attacks. Fix the code to verify TLS before use, or run with network restrictions. - Data exfiltration surface: the skill fetches third‑party web content and writes outputs; it also expects the agent/LLM to read llm_input_*.json for summaries. This is expected for its purpose, but be mindful of what content will be sent to any LLM (the agent's model) — do not feed sensitive internal data. - Prompt injection / obfuscation: SKILL.md contained unicode control characters (scanner flagged). Manually inspect SKILL.md and any created llm_input files for hidden characters or instructions before allowing the agent to use them with an LLM. Recommended actions: run the skill only in a sandboxed environment (container or VM) until you remove/patch hardcoded paths and re-enable TLS verification; or ask the publisher to provide a version without absolute paths and with secure HTTP handling. If you lack ability to audit/modify the code, treat this skill as potentially risky and avoid installing it in a production or credentialed environment.

Type: OpenClaw Skill Name: walter-info Version: 1.1.0 The skill bundle contains multiple scripts (check_files.py, cleanup.py, and scripts/apply_llm_summaries.py) with hardcoded absolute file paths pointing to a specific local user directory (C:\Users\beyon\...), which is highly irregular for portable skills. Furthermore, scripts/fetch_news.py and scripts/run.py explicitly disable SSL certificate verification (ssl.CERT_NONE) when scraping news from ennews.com and cifnews.com, creating a significant security vulnerability. While the stated purpose of fetching e-commerce news and weather is maintained, these poor security practices and environment-specific scripts are risky.