Openweather Api
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: openweather-api Version: 1.0.4 The skill bundle provides legitimate instructions for integrating the OpenWeather API via the Membrane CLI. The SKILL.md file outlines standard procedures for installation, authentication, and action execution using the '@membranehq/cli' tool. The behavior is clearly aligned with the stated purpose, and there are no indicators of malicious intent, data exfiltration, or prompt injection attacks.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing a global CLI gives that package command-line execution capability on the user's machine.
The skill asks the user to install the Membrane CLI globally from npm using the latest version. This is a normal setup step for the stated Membrane-based integration, but it introduces dependency/provenance risk.
npm install -g @membranehq/cli@latest
Install only if you trust Membrane and npm package provenance; consider pinning or reviewing the CLI version in managed environments.
The integration may keep access to the connected Membrane/OpenWeather account so future weather API actions can run without repeated login.
The skill relies on Membrane-managed authentication and credential refresh for the OpenWeather connection. This is expected for an API integration, but users should recognize that credentials or delegated access are involved.
Membrane handles authentication and credentials refresh automatically
Use the intended Membrane account, review the created connection, and revoke it when no longer needed.
The agent can run OpenWeather-related API actions through Membrane, which may use account quota or reveal queried locations to the provider.
The skill documents running discovered Membrane actions against a specific connection. This fits the OpenWeather API purpose, but action execution is a broad integration mechanism.
membrane action run <actionId> --connectionId=CONNECTION_ID --input '{"key": "value"}' --jsonKeep actions scoped to the intended OpenWeather connection and review unusual or non-weather-related action requests before running them.