v2026.4.16

korea-air-quality

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:33 AM.

Analysis

This appears to be a purpose-aligned Korean air-quality skill, with noteworthy but disclosed local storage for locations/preferences, optional API-key use, and recurring alert/briefing workflows.

GuidanceThis skill looks reasonable for air-quality lookup and alerts. Before installing, be comfortable with it storing local preference/location files, optionally using an AirKorea API key, and creating recurring alert or briefing workflows when you ask for them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Rogue Agents

SeverityLowConfidenceHighStatusNote

SKILL.md

반복 감시는 watch 성격의 로컬 규칙 + OpenClaw cron 조합으로 설계한다.

The skill supports recurring alert or briefing behavior through local rules and OpenClaw cron planning. This is disclosed and matches the alert/briefing purpose, but it creates persistent automation.

User impactAfter you set up alerts or morning briefings, the agent may keep checking conditions on a schedule until the rule or cron job is removed.

RecommendationReview created alert rules and cron jobs periodically, and remove rules you no longer want.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

scripts/air_quality.py

api_key = os.getenv("AIRKOREA_API_KEY") or cfg.get("airkorea_api_key")

The skill can use an AirKorea API key from an environment variable or local config file. This is expected for the AirKorea provider, but it is still credential handling.

User impactIf you configure AirKorea, the service key may be read from your environment or stored locally for future calls.

RecommendationUse a service-specific API key, prefer environment variables when possible, and protect or delete data/config.json if you no longer want the key stored locally.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityMediumConfidenceHighStatusNote

SKILL.md

저장 위치는 `data/user-preferences.json` 같은 로컬 파일을 우선 고려한다. 사용자별 식별자가 필요하면 채널 사용자 id를 키로 쓴다. 현재 버전은 지역명 저장과 좌표 저장(`save-location`) 모두 지원한다.

The skill intentionally persists user IDs, default regions, and saved coordinates in local files so they can be reused across later requests.

User impactYour default area or exact saved coordinates could remain on disk and be reused in future air-quality lookups or briefings.

RecommendationOnly save locations you are comfortable persisting locally, and remove data/user-preferences.json or use the delete-default flow when you no longer want this context retained.