Weather Push

ReviewAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent personal weather/status notification skill, but it uses scheduled execution, SSH access to a private server, and a hardcoded Feishu recipient that users should verify.

Before installing, confirm this is meant for your environment: update the Feishu target if needed, ensure SSH access to 10.144.1.3 is expected and restricted, and decide whether the daily 8:00 scheduled push should be active.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI10: Rogue Agents

What this means

If installed with scheduling enabled, it may send a Feishu notification every morning until disabled.

Why it was flagged

The skill declares a recurring scheduled run, which is persistent behavior, but it is consistent with the stated daily weather push purpose.

Skill content

metadata:
  cron: "0 8 * * *"

Recommendation

Confirm the cron schedule is desired and know how to disable or remove the scheduled task.

Medium

#ASI03: Identity and Privilege Abuse

What this means

The skill can use the installer's available SSH credentials/configuration to access the configured mihomo server.

Why it was flagged

The script uses SSH access to a specific private server account to check service status. This is purpose-aligned, but it relies on local SSH authority.

Skill content

ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no sulada2@10.144.1.3 "systemctl is-active mihomo 2>/dev/null"

Recommendation

Only install/run it in an environment where SSH access to sulada2@10.144.1.3 is expected, and consider using a restricted account for status checks.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A misdirected or impersonated SSH endpoint would be less likely to be blocked by host key verification.

Why it was flagged

The SSH call disables strict host key checking, which makes host identity verification weaker than normal SSH defaults.

Skill content

ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no sulada2@10.144.1.3

Recommendation

Pin or verify the SSH host key instead of using StrictHostKeyChecking=no where possible.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Weather details and the mihomo service status will be sent to the configured Feishu recipient.

Why it was flagged

The script sends the composed weather and mihomo status message to a hardcoded Feishu target. This is the stated purpose, but it is an external communication boundary users should verify.

Skill content

openclaw message send \
    --channel feishu \
    --target "ou_b07b92c096b2f0f7260a2ee106241605" \
    --message "$MESSAGE"

Recommendation

Verify the Feishu target ID and message contents before running or scheduling the skill.