v1.0.3

Weather Pollen

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 4:52 AM.

Analysis

This skill appears purpose-aligned and benign, but users should know it sends configured coordinates to external weather services and its pollen lookup is hard-coded to Anna, TX.

GuidanceThis skill is reasonable for weather lookups, but before installing, be comfortable sharing the configured coordinates with Open-Meteo and remember that pollen data appears fixed to Anna, TX despite the broader location wording.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Human-Agent Trust Exploitation

SeverityLowConfidenceHighStatusNote

logic.ts

'https://www.pollen.com/api/forecast/current/pollen/75409'

The pollen API endpoint is fixed to ZIP 75409, so pollen results are not actually location-variable even though the skill description says reports are for any location.

User impactIf you ask for or configure another location, the weather may change but the pollen report may still reflect Anna, TX.

RecommendationTreat pollen output as Anna, TX-specific unless the skill is updated to make pollen location configurable.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The registry metadata does not provide a source repository or homepage, which limits provenance review. The included artifacts do not show a remote installer, hidden helper, or suspicious dependency behavior.

User impactYou have less external provenance information about the publisher and project history.

RecommendationInstall only if you trust the registry entry or publisher; a source link would improve reviewability.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

logic.ts

`https://api.open-meteo.com/v1/forecast?latitude=${WEATHER_LAT}&longitude=${WEATHER_LON}`

The skill sends configured latitude and longitude values to an external weather provider. This is disclosed and necessary for the weather feature, but it is still location sharing.

User impactYour configured coordinates are sent to Open-Meteo when the tool is used.

RecommendationUse only location coordinates you are comfortable sharing with the weather provider, and do not put secrets in the WEATHER_* variables.