中国城市天气Weather in China

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI05: Unexpected Code Execution

What this means

If the weather page, network response, or parsed HTML content contains shell metacharacters, running the skill could execute unintended commands on the user's machine.

Why it was flagged

The script fetches HTML from the network, parses it into variable-assignment text, and then passes that text to eval. The title-derived WEATHER value is not shell-escaped before evaluation.

Skill content

html=$(curl -s --max-time 10 "$url" 2>/dev/null)
...
weather_data=$(parse_weather "$html")
...
eval "$data"

Recommendation

Remove eval and parse the fields safely, for example by assigning only known keys after strict validation or by using a structured format that is not executed as shell code.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

The queried city is sent to the external weather service, and results depend on network access and that site's response.

Why it was flagged

The skill uses curl to contact China Weather for the selected city code. This is expected for the stated weather lookup purpose.

Skill content

local url="https://www.weather.com.cn/weather/${city_code}.shtml"
html=$(curl -s --max-time 10 "$url" 2>/dev/null)

Recommendation

Use the skill only where external weather.com.cn requests are acceptable, and avoid relying on it in restricted or offline environments.