Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
super-weather
v1.0.0Get current weather and forecasts (no API key required).[boston tonight today normally im reno chicago sunday roughly 190 raining umbrella acceptable shit warm]
⭐ 0· 29·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The declared purpose—terminal weather via wttr.in and Open‑Meteo—matches the instructions and the only required binary (curl). However the package metadata in _meta.json (different ownerId, slug 'weather') does not match the registry metadata for this skill (ownerId and slug 'super-weather'), and the description contains an odd bracketed token string (looks like search keywords or stray input). These inconsistencies don't break the stated purpose but reduce trust in provenance.
Instruction Scope
SKILL.md only instructs using curl to call wttr.in and Open‑Meteo (public endpoints) and shows examples for text and PNG output; it does not request local file reads, extra env vars, or unrelated data. However the SKILL.md appears malformed/truncated (an Open‑Meteo example block is cut off) and contains unrelated tokens in the header—suggesting sloppy packaging or a copy/paste error that should be verified.
Install Mechanism
Instruction-only skill with no install spec and no code files. This is low-risk from an install/mechanism perspective—nothing is downloaded or written to disk by an installer.
Credentials
No environment variables, credentials, or config paths are requested. The required binary (curl) is proportionate to the described functionality.
Persistence & Privilege
Skill is not always-enabled and uses default model invocation settings. It does not request elevated or persistent privileges.
What to consider before installing
This skill appears to do only what it says: call wttr.in and Open‑Meteo with curl and return weather info, and it requires no credentials. However the package metadata and SKILL.md contain inconsistencies (mismatched owner/slug in _meta.json, stray bracketed tokens in the description, and a truncated example). These look like sloppy packaging or a copy/paste issue and reduce confidence in provenance. Before installing: (1) verify the skill author/owner in the registry UI, (2) open the full SKILL.md on the registry to confirm the content isn't truncated or malicious, and (3) prefer using it only if you trust the registry owner or if you can inspect the displayed instructions yourself. If provenance is unclear, avoid installing or run it in a constrained environment (no sensitive network access) — the skill itself does not request secrets but the metadata mismatch is a red flag worth investigating.Like a lobster shell, security has layers — review code before you run it.
latestvk973p9t79dpfsg6p1a7da4jejh843k7n
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
☁️ Clawdis
Binscurl