中国城市天气Weather in China

中文天气查询工具 - 使用中国天气网获取实时天气（无需API密钥，不依赖大模型）

The skill is functionally coherent, but the bundled script uses eval on data derived from fetched HTML (and therefore untrusted). That creates a real risk of command injection if the remote page or the local city file is maliciously modified. Before installing or running: (1) review or run the script only in an isolated environment (container or low-privilege account); (2) avoid running it as root; (3) fix the code by removing eval — parse the key=value output safely (for example, read lines and assign variables explicitly or whitelist keys and sanitize values), or escape values before eval; (4) verify weather_codes.txt hasn't been tampered with; (5) consider adding strict input validation on city_code (digits only) and stricter extraction of values (strip quotes/unsafe characters). If you want, I can provide a patched version of the script that avoids eval and is safer to run.

Type: OpenClaw Skill Name: weather-cn Version: 1.0.1 The skill is classified as suspicious primarily due to the use of `eval "$data"` in the `format_output` function within `weather-cn.sh`. While the input `$data` is derived from `grep` and `sed` operations with specific patterns on external HTML, `eval` is an inherently dangerous function that introduces a shell injection vulnerability. Although the current parsing logic makes direct exploitation difficult, it's a critical security flaw. The skill also uses `curl` to fetch data from an external website (weather.com.cn), which is expected for its functionality but represents a network access capability.