weather-query-ych

查询指定城市和日期的天气预报，提供天气状况及温度范围，支持中文城市名和日期解析。

This skill appears to do weather lookups, but the author put an API key directly in the code and did not declare any required credentials — that's a red flag. Before installing: (1) ask the publisher to explain the API key origin and revoke it if it's private; (2) prefer a version that accepts an API key via an environment variable or configuration you control; (3) verify the external endpoint (the code uses api.weather.com-style URLs) and ensure it's trustworthy; (4) if you must use it, monitor network activity and consider running it in an isolated environment. If you cannot verify the key/provider, treat the skill as untrusted.

Type: OpenClaw Skill Name: weather-query-ych Version: 1.0.0 The skill is classified as suspicious due to significant vulnerabilities related to input sanitization. The `agent.py` file directly interpolates user-provided `city` and `date` values into the API URL without validation, creating a URL injection/SSRF vulnerability. This could allow an attacker to manipulate the API endpoint or potentially target internal network resources if the environment permits. Additionally, the hardcoded API key is a security bad practice, and the naive input parsing `input_text.split("天气")[0]` further exacerbates the risk of malformed input reaching the vulnerable URL construction.