Weather
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: laomo-weather Version: 2.1.0 The laomo-weather skill is a well-documented and feature-complete weather utility that provides current conditions, AQI, pollen data, and lifestyle suggestions using public APIs (wttr.in and Open-Meteo). Analysis of the JavaScript implementation (lib/api.js, lib/client.js) and the auxiliary bash script (weather.sh) shows no evidence of data exfiltration, malicious command execution, or prompt injection. All network requests are directed to legitimate weather service endpoints, and the skill operates entirely within its stated purpose without requesting sensitive permissions or accessing local system secrets.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The city or coordinates you ask about may be visible to weather API providers.
The skill sends the requested location to an external weather API; this is expected for weather lookup, but it is still a third-party data flow.
const url = `${this.base}/${encodeURIComponent(location)}?format=${format}`; const res = await fetch(url);Use general city names instead of precise private coordinates if you are sensitive about location privacy.
Installation or execution may depend on runtime details not fully captured by the registry requirements.
The package also includes runnable JavaScript files and documentation comments referencing npm/node usage, so the runtime expectations are not fully reflected in the install metadata.
No install spec — this is an instruction-only skill.
Before installing, verify how the skill will be invoked and whether any Node/package dependencies are required in your environment.