DHMZ Weather

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: dhmz-weather Version: 1.0.0 The skill is benign. It uses `curl` to fetch weather data in XML format from official Croatian meteorological service domains (`meteo.hr`, `vrijeme.hr`, `prognoza.hr`, `klima.hr`, `hidro.hr`). There is no evidence of data exfiltration, malicious execution (e.g., piping `curl` output to `bash`), persistence mechanisms, or harmful prompt injection against the agent. The instructions for the agent are to fetch and display weather data directly, which aligns with the stated purpose.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Using the skill may cause your agent to make network requests to Croatian public weather websites to retrieve XML weather data.

Why it was flagged

The skill instructs the agent to use curl for outbound requests to public weather XML endpoints; this is disclosed and central to the weather lookup purpose.

Skill content

curl -s "https://vrijeme.hr/hrvatska_n.xml"

Recommendation

Use the skill if you are comfortable with outbound requests to the listed weather domains; no API key or personal credential is required.