Back to skill
Skillv1.0.0
VirusTotal security
Weather Ultra · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 29, 2026, 7:29 AM
- Hash
- 0f01dd2d3ca63fb37f65bc39d6d89a9beacd4d5d9fd273524332b751ca8612d6
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: weather-ultra Version: 1.0.0 The skill provides weather and photography-related lighting data by querying external APIs (api.weatherapi.com and api.sunsethue.com). It is classified as suspicious because the script `scripts/weather-full.sh` lacks input sanitization for the `CITY` and `DAYS` arguments, which are used directly within a `curl` command. This creates a shell injection vulnerability where a crafted input (e.g., using backticks or command substitution) could lead to arbitrary code execution. No evidence of intentional malice or data exfiltration was found.
- External report
- View on VirusTotal