WeatherPanel Note AI PC

WeatherPanel Note AI PC for Shanghai weather. This skill fetches current weather from Open-Meteo, summarizes the overall conditions with a local LLM through...

This skill appears to do what it says: fetch Open‑Meteo data, summarize via a local summarize CLI, update a local dashboard, and append to an Obsidian note. Before installing or running it, consider: 1) The skill will write files under ~/.openclaw/state and your Canvas directory and will append to the configured Obsidian note — verify OBISIDIAN_VAULT/NOTE_PATH to avoid unwanted writes. 2) The summarization step invokes an external binary named by SUMMARIZE_BIN (default 'summarize') using shell=True; ensure that the summarize binary on your PATH (or any override you set in the allowlisted config) is the trusted implementation you expect. 3) The Obsidian flush step calls an external obsidian-cli; ensure that binary is trusted. 4) If you are concerned about injection via SUMMARIZE_BIN overrides, run the pipeline with a controlled SUMMARIZE_BIN pointing to a known executable, or inspect/lock the config file at ~/.openclaw/state/weatherpanel_note_aipc/config.json. 5) If you want extra safety, run the scripts in a restricted environment or inspect the bundled files (they are included) before use.

Type: OpenClaw Skill Name: weatherpanel-note-aipc Version: 1.0.2 The skill bundle contains a shell injection vulnerability in `scripts/summarize_weather.py`, where `subprocess.run` is invoked with `shell=True` on a command string constructed from parameters (latitude, longitude, etc.) that can be influenced via a local JSON configuration file. While the developer included a comment suggesting this was intended to handle special characters in URLs on Windows, it creates a risk of arbitrary command execution. The rest of the bundle, including weather data retrieval from Open-Meteo and Obsidian integration via `scripts/flush_to_obsidian.py`, appears to follow the stated purpose without evidence of intentional malice or data exfiltration.