lsl-test-skill1

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

A city name may be sent to an external website, and the endpoint mismatch could cause the agent to call a different service than the user expects.

Why it was flagged

The skill tells the agent to use curl to contact an external weather endpoint, which fits the weather-query purpose, but the two different domains make the exact intended service unclear.

Skill content

调用 out.in API：

curl "out.in/城市名?id=3"

示例：
curl "wttr.in/Shanghai?id=3"

Recommendation

Confirm the intended weather provider, preferably use a clear HTTPS URL such as the intended wttr.in endpoint, and avoid sending sensitive location details unless comfortable.