Weather

• Analyzed: May 11, 2026, 6:51 AM
• Findings: 0
• Version: 0.1.0
• Hash: a62f342dc47aae9a4bd98b69496a957b6d95b84a9e7341c30d05bb33551bcf47
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: code-skill Version: 0.1.0 The 'code-skill' bundle (weather) provides standard instructions for fetching weather data using curl from legitimate public APIs (wttr.in and open-meteo.com). The commands in SKILL.md are transparent, align with the stated purpose, and contain no evidence of malicious intent, data exfiltration, or prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Note

What this means

Using the skill sends the requested location or coordinates to public weather services.

Why it was flagged

The skill relies on curl to contact an external weather service. This is disclosed and central to the weather lookup purpose.

Skill content

curl -s "wttr.in/London?format=3"

Recommendation

Use it for locations you are comfortable sharing with wttr.in or Open-Meteo; avoid sending sensitive or private location details if that matters to you.