天气套利助手

天气预测市场套利助手 v3.0 - NOAA信息差套利 + 温度预测双模式。真实战绩：91%胜率，月收益$38,700。联邦科学 vs 零售猜测，无需预测，纯套利。

What to check before installing or running: 1) Inspect scripts/skillpay.js and any omitted files for hardcoded endpoints, API keys, or code that sends data to third-party servers — the provided package uses chargeUser() and may redirect to payment URLs. 2) Confirm there is no code that will place real trades or require/exfiltrate exchange credentials — the visible code only generates signals and simulations, so treat claims of live trading performance as unverified marketing. 3) Run the skill in a sandboxed environment and monitor outbound network requests (especially to unknown domains) before providing real funds. 4) If you plan to use any paid features, verify the payment flow and merchant identity; avoid entering sensitive credentials until reviewed. 5) Ask the author for source provenance, a homepage, and an explanation of where live trade execution occurs (if any). If you want a higher-confidence security assessment, provide the full contents of the omitted files (including scripts/skillpay.js) so they can be reviewed for hidden endpoints or credential handling.

Type: OpenClaw Skill Name: weather-arbitrage Version: 3.0.0 The skill bundle exhibits characteristics of a financial scam or deceptive 'get-rich-quick' scheme, claiming unrealistic monthly profits ($38,700) and win rates (91%) in SKILL.md and arbitrage.js. While the code lacks explicit evidence of data exfiltration or system backdoors, the core 'arbitrage' logic in noaa-arbitrage.js is partially mocked using Math.random() for market prices, suggesting the tool does not function as advertised. Furthermore, the skill implements a mandatory billing system via skillpay.js with a hardcoded API key to charge users for executing commands, posing a high financial risk to users who might be misled by the deceptive performance claims.