Weather via OpenMeteo (via openmeteo-sh cli; simple ver)

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent may run the openmeteo command to answer weather questions.

Why it was flagged

The skill instructs the agent to invoke a local CLI with user-provided location arguments, which is expected for this weather integration.

Skill content

openmeteo weather --current --city=Berlin --llm

Recommendation

Keep using the documented quoting pattern for city names and only install a trusted openmeteo CLI.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the prerequisite CLI gives code from the external openmeteo-sh source access to run locally.

Why it was flagged

The README directs users to install an external CLI package from third-party package sources; this is disclosed and purpose-aligned but depends on trusting that source.

Skill content

brew tap lstpsche/tap
brew install openmeteo-sh

Recommendation

Install only from the official project or a trusted package channel, and review privileged install steps before running them.

Note

ASI07: Insecure Inter-Agent Communication

What this means

The city or coordinates used for a weather query may be sent to Open-Meteo.

Why it was flagged

Weather lookups require sending the requested city or coordinates to the external Open-Meteo API; the endpoints are clearly disclosed.

Skill content

This skill invokes the `openmeteo` CLI, which makes HTTPS requests to:
- `https://api.open-meteo.com`
- `https://geocoding-api.open-meteo.com`

Recommendation

Avoid querying locations you consider sensitive, or review Open-Meteo's privacy practices before use.