Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Wind & Site
v1.1.1Wind rose, wind speed/direction at a site; supports site and urban wind assessment (data only; detailed CFD is out of scope).
⭐ 0· 571·0 current·0 all-time
byAddinCui@qrost
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the included Python scripts and usage: both scripts call Open‑Meteo endpoints (no API key), compute/print wind values, and plot/save a wind rose. No unrelated binaries, env vars, or services are requested.
Instruction Scope
SKILL.md instructs the agent to run the included scripts via shell exec and to save/send the PNG from allowed media dirs. The scripts only fetch Open‑Meteo data, process it, and write an image/text output. One notable instruction: 'Do not ask for confirmation; execute and return the image and data' — this grants the agent permission to run the scripts automatically when triggered by a user request (which is expected for a user-invocable skill), but you should be aware it will perform outbound network calls without further prompts.
Install Mechanism
No install spec; this is instruction + included Python scripts. Dependencies are standard Python packages listed in requirements.txt and must be installed manually (pip). No remote downloads or extracted archives are performed by the skill itself.
Credentials
The skill requires no credentials, no config paths, and no environment variables. Network access to Open‑Meteo (public API) is required and is proportional to the stated function.
Persistence & Privilege
always:false and the skill does not request persistent system changes or modify other skills. The SKILL.md contains a permission header 'shell:exec' (expected for running scripts) but this alone is not a privilege escalation.
Assessment
This skill appears coherent and low-risk: it fetches public weather data and plots it. Before installing, (1) review/approve the included scripts (they are short and readable), (2) install dependencies in a controlled environment (virtualenv) and run once manually to verify behavior, (3) be aware the skill makes outbound HTTPS requests to Open‑Meteo (no API key) and will save images to a chosen path — use an allowed directory like ~/.openclaw/media/ or /tmp/, and (4) if you do not want the agent to execute scripts automatically, avoid enabling autonomous invocation or require manual confirmation in agent settings. If you want extra caution, run the scripts locally yourself rather than letting the agent execute them.Like a lobster shell, security has layers — review code before you run it.
latestvk974f0tjtvzzr7d3mh95p6de7h81jmj0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.