lsl-test-skill1

PassAudited by ClawScan on May 1, 2026.

Overview

This is a simple instruction-only weather skill with no code or credentials, though users should verify the intended external weather endpoint because the documentation mentions two different domains.

Before installing, verify which weather API domain the skill should use. Otherwise this appears to be a low-risk, instruction-only weather lookup skill that does not request credentials or install code.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

A city name may be sent to an external website, and the endpoint mismatch could cause the agent to call a different service than the user expects.

Why it was flagged

The skill tells the agent to use curl to contact an external weather endpoint, which fits the weather-query purpose, but the two different domains make the exact intended service unclear.

Skill content

调用 out.in API：

curl "out.in/城市名?id=3"

示例：
curl "wttr.in/Shanghai?id=3"

Recommendation

Confirm the intended weather provider, preferably use a clear HTTPS URL such as the intended wttr.in endpoint, and avoid sending sensitive location details unless comfortable.