Weather Outfit Advisor
PassAudited by ClawScan on May 10, 2026.
Overview
The skill’s behavior matches its weather-and-outfit purpose, but users should know it calls external APIs and includes a bundled Pexels API key.
This skill appears safe for normal weather-based outfit advice. Before installing, be aware that it may send destination and fashion-search terms to external providers, and that image search uses a bundled Pexels API key rather than a per-user credential.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your destination query may be visible to the external weather provider.
The destination city is sent to the external wttr.in service to retrieve weather data; this is purpose-aligned but still discloses user-provided travel location to a third party.
url = f"https://wttr.in/{city}?format=j1"Avoid including unnecessarily sensitive travel details, and use the skill only when you are comfortable with weather/image providers receiving the relevant query.
Image searches may run under a shared key, which could hit rate limits, be revoked, or associate queries with the key owner rather than your own account.
The script contains a bundled Pexels API key and uses it for image search; this is related to the outfit-image feature, but shared hardcoded credentials are brittle and not isolated per user.
pexels_api_key = "D6nVsjiU...FNNO"
Prefer a user-provided API key via environment variable, or disable image search if you do not want queries sent through the bundled credential.
Running the full advice generator executes local Python helper scripts; if run from an unexpected directory, relative script lookup could fail or use the wrong local file.
The combined advice script runs local helper scripts with fixed arguments and no shell; this is purpose-aligned, but users should recognize that it requires local Python execution.
cmd = ["python3", script_name] + list(args) result = subprocess.run(cmd, capture_output=True, text=True)
Run the scripts from the intended skill directory, and maintainers should resolve helper paths relative to the script file.