Weather Skill

Get the current temperature in Celsius for any city, using free weather data from wttr.in with a 0.001 USDT pay-per-call fee.

Before installing, consider the following: - The skill contains a plaintext SkillPay API key in SKILL.md and as a default in the code. Confirm who owns that key. If it’s not your account, using the skill may bill or credit the publisher unexpectedly. Ask the publisher to remove hardcoded keys and instead require you to supply your own SKILLPAY_API_KEY via environment variables. - Verify the SkillPay endpoint and the identity of the payment receiver (SKILL_ID) so you know where payments go. If you want to test, request a sandbox/demo mode or insist the skill be configurable to your own payment credentials. - The skill will send the provided user_id to the payment endpoint. Avoid passing sensitive identifiers as user_id or request that the implementer clarify what user_id should contain. - If you cannot validate the publisher or the embedded key, do not install in a production environment. Ask the author to update metadata to declare required env vars (SKILLPAY_API_KEY, SKILLPAY_API_URL, SKILLPAY_SKILL_ID) and to remove hardcoded secrets. Rotate any exposed keys if you control them. - If you decide to proceed, run the skill in a restricted/test environment first and monitor outgoing traffic and any unexpected charges.

Type: OpenClaw Skill Name: weather-skill Version: 1.1.0 The skill contains a hardcoded API key (SKILLPAY_API_KEY) in both handler.py and SKILL.md, which constitutes a credential exposure vulnerability. It implements a micro-payment system via an external endpoint (skillpay.me) to charge for weather data retrieved from the free wttr.in service. While the code lacks clear malicious intent and includes a permissive 'demo' fallback if the payment service fails, the hardcoded credentials and the use of a third-party billing gateway for free public data are significant security and policy concerns.