Wind & Site

Wind rose, wind speed/direction at a site; supports site and urban wind assessment (data only; detailed CFD is out of scope).

This skill appears coherent and low-risk: it fetches public weather data and plots it. Before installing, (1) review/approve the included scripts (they are short and readable), (2) install dependencies in a controlled environment (virtualenv) and run once manually to verify behavior, (3) be aware the skill makes outbound HTTPS requests to Open‑Meteo (no API key) and will save images to a chosen path — use an allowed directory like ~/.openclaw/media/ or /tmp/, and (4) if you do not want the agent to execute scripts automatically, avoid enabling autonomous invocation or require manual confirmation in agent settings. If you want extra caution, run the scripts locally yourself rather than letting the agent execute them.

Type: OpenClaw Skill Name: wind-site Version: 1.1.1 The skill is classified as suspicious due to a significant prompt injection vulnerability against the OpenClaw agent. The `SKILL.md` file explicitly instructs the agent to use `shell:exec` to run Python scripts (`scripts/wind_info.py`, `scripts/wind_rose.py`) with parameters directly derived from user input. If the agent does not robustly sanitize or quote these user-provided parameters when constructing the shell command, a malicious user could inject arbitrary shell commands, potentially leading to Remote Code Execution (RCE). Additionally, `scripts/wind_rose.py` writes to an `output_path` directly from arguments, which, if combined with prompt injection, could lead to arbitrary file writes, despite `SKILL.md` attempting to guide the agent to use 'allowed paths'.