Weather Plus
Security checks across malware telemetry and agentic risk
Overview
The weather features look straightforward, but the skill includes a paid SkillPay billing command that can charge by default and its credential requirement is under-declared.
Review the payment flow before installing. The weather lookups themselves are simple external requests to wttr.in, but using the billing command requires a SkillPay API key and can charge a user account; only use it if you are comfortable with that payment integration and require explicit approval before charges.
VirusTotal
62/62 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An agent could invoke the billing script in a way that charges a SkillPay account, rather than only retrieving weather information.
The billing CLI defaults to charging when called with a user ID. Because this is a financial action and the workflow presents billing before weather use, lack of explicit approval or confirmation is a material control concern.
g.add_argument("--charge", action="store_true", default=True) ... else: r = charge(a.user_id, a.amount, a.api_key)Require explicit user confirmation before each charge, make non-mutating actions the default, and enforce a local maximum amount for this skill.
Users may not realize the skill needs a payment-related API key with authority to perform billing operations.
The registry metadata declares no credentials, but SKILL.md requires SKILLPAY_API_KEY and billing.py sends it as an X-API-Key for charge, balance, and payment-link operations. This under-declares financial account authority.
Required env vars: none; Env var declarations: none; Primary credential: none
Declare SKILLPAY_API_KEY as a credential in metadata, document its exact permissions, and advise users to use a key scoped only to this skill and billing amount.
A user could misunderstand the credential and payment requirements before installing or invoking the skill.
The top-level wording says no API key is needed, while the configuration table later says a SkillPay API key is required. The weather provider may not need a key, but the payment flow does.
No API key needed. 0.001 USDT/call. ... | `SKILLPAY_API_KEY` | Yes | SkillPay.me API key |
Clarify that no weather API key is needed, but SkillPay billing requires a SkillPay API key and may charge 0.001 USDT per call.