Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Weather-Webcam-V2

Fetches current weather from Open-Meteo API and automatically captures a live webcam image from Meteoblue or Windy for the requested location. Use it when th...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 221 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The skill claims to fetch weather and webcam images and requires agent-browser and curl, plus includes a small DOM-extraction snippet (webcam_extractor.js) and a webcams.json lookup — all of which are reasonable and expected for this function. Minor inconsistency: _meta.json uses slug "weather-location" and version 1.2.0 while registry metadata lists "weather-webcam-v2" v1.0.0, which looks like bookkeeping mismatch but not functional mismatch.
Instruction Scope
SKILL.md instructions stay within the stated goal (geocode via Open‑Meteo, fetch weather, open webcam pages with agent-browser, extract image URLs, curl the image, send it). A few points to note: the web-search step is underspecified (no search engine/tool is named), the example eval filters (/full/ and original.jpg) do not exactly match the provided webcam_extractor.js filters (js looks for 'imgproxy'/'webcam'/'original.jpg'), and the instructions show clicking cookie banners and running page eval — expected for scraping images but requires the agent-browser tool to execute arbitrary JS on pages.
Install Mechanism
There is no install spec (instruction-only plus small included JS), so nothing is downloaded or executed at install time. That is appropriate for this kind of skill.
Credentials
The skill requests no environment variables, no credentials, and no config paths. This is proportionate: fetching public weather data and public webcam images doesn't require secrets.
Persistence & Privilege
always is false and model invocation is allowed (platform default). The skill does not request permanent presence or system-wide config changes. It writes to an agent workspace path (/home/user/.openclaw/workspace/webcam.jpg), which is consistent with OpenClaw workspace usage.
Assessment
This skill appears to do what it advertises: call Open‑Meteo, browse public webcam pages, extract an image, and return it. Before installing, consider: (1) agent-browser will execute JavaScript on arbitrary third‑party pages — that is required to click cookie dialogs and extract images but means the skill can interact with pages you navigate to; (2) the SKILL.md relies on an absolute agent-browser binary path which may differ on your system; (3) the metadata files show a small slug/version mismatch (nonfunctional but worth noting). If you’re comfortable letting the agent use agent-browser to visit external sites and download images, the permissions requested are proportional. If you need stricter controls, avoid enabling web‑browsing skills or review/modify the instructions to restrict which domains may be visited.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk971b48y74k975ekk2n5ra7thn825haqweathervk971b48y74k975ekk2n5ra7thn825haq

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

Binsagent-browser, curl

SKILL.md

Weather Location

This skill automates weather data retrieval using Open-Meteo and live webcam image capture using agent-browser.

Workflow

  1. Get Coordinates (Geocoding):

    • Execute curl -s "https://geocoding-api.open-meteo.com/v1/search?name=[Location]&count=1&language=es&format=json" to resolve city name to coordinates.
  2. Get weather (Open-Meteo):

    • Execute curl -s "https://api.open-meteo.com/v1/forecast?latitude=[Lat]&longitude=[Lon]&current=temperature_2m,relative_humidity_2m,apparent_temperature,weather_code,wind_speed_10m" to get real-time data.
  3. Search for Webcam:

    • Web search for site:meteoblue.com [Location] webcam or site:windy.com [Location] webcam.
    • Select the direct link to the location's webcam page.
  4. Capture Image (Agent Browser Method):

    • Use agent-browser to navigate and interact:
      /home/user/.npm-global/bin/agent-browser --session-name webcam open "[URL]"
      
    • Interaction:
      • Click "OK/Accept" on cookie banners using snapshot + click @ref.
    • Extraction:
      • Use eval to find the highest resolution URL (look for /full/ and original.jpg):
        Array.from(document.querySelectorAll('img')).map(img => img.src).filter(src => src.includes('original.jpg') && src.includes('/full/'))[0]
        
    • Download:
      • Download with curl to /home/user/.openclaw/workspace/webcam.jpg.
  5. User Response:

    • Send with message(action=send, media="/home/user/.openclaw/workspace/webcam.jpg", caption="[City]: [Icon] [Temp]°C [Humidity]% [Wind]km/h\n[Comment]").
    • Respond with NO_REPLY.

Optimization (Token Saving)

  1. Open-Meteo API: Faster, keyless, and more reliable than wttr.in.
  2. Agent Browser: Priority method for Alex to ensure interaction (cookies) and high-quality images.
  3. Session Persistence: Use --session-name webcam to keep cookies.

Files

4 total
Select a file
Select a file to preview.

Comments

Loading comments…