Weather Push

每日天气推送 - 定时发送深圳天气+mihomo服务状态到飞书

This script is coherent with its weather+service-check purpose, but review and adapt it before enabling: - Inspect and change hard-coded values: the SSH target (10.144.1.3), SSH user (sulada2), and the Feishu target OU ID are baked into the script; replace with your own targets or make them configurable. - Provide SSH credentials intentionally: the script expects an SSH key/agent to allow passwordless SSH. Confirm which key will be used and do not expose private keys. - Re-enable host-key verification: StrictHostKeyChecking=no weakens SSH security and can allow MitM; consider using known_hosts or more secure SSH options. - Verify the openclaw CLI path: /home/aisulada/.npm-global/bin/openclaw is user-specific and may not exist; change to the correct path or use a configurable command. - Check logging and confidentiality: logs are written to /tmp/weather-push.log; ensure log files are stored securely if they contain sensitive identifiers. - Test in a safe environment first: run manually and confirm outputs, SSH behavior, and that messages are sent to the expected Feishu recipients. If you want a lower-risk version, request the maintainer remove hard-coded hosts/users, make paths and targets configurable via declared env vars, and avoid disabling SSH host-key checks.

Type: OpenClaw Skill Name: weather-push Version: 1.0.0 The skill is classified as suspicious due to critical vulnerabilities, specifically the use of `StrictHostKeyChecking=no` in SSH connections to `10.144.1.3` in `push.sh`, which makes it vulnerable to Man-in-the-Middle attacks. Additionally, the `parse_weather_json` function in `push.sh` embeds raw `curl` output directly into a Python script string literal (`json.loads('''$DATA''')`), creating a potential Python code injection vulnerability if the `curl` output could be manipulated. While the skill's stated purpose (weather and service status updates) appears benign, these vulnerabilities present significant security risks.