Security audit
Weather Forecast Plus
Security checks across malware telemetry and agentic risk
Overview
The skill's curl-based weather endpoints match its stated purpose, but the SKILL.md contains contradictory privacy claims and a caching requirement that asks the agent to write local files with system username and machine name — behavior that is disproportionate and unexplained for a weather skill.
This skill appears to do what it claims (fetch weather via an aggregator) and is low-friction to run, but proceed with caution. Specific issues to consider before installing: - Caching contradiction: The SKILL.md claims 'no data storage' yet requires saving responses locally when cache_policy is 'local'. Ask the maintainer to clarify or remove this contradiction. - Sensitive metadata in cache: The skill instructs including the system username and machine name in weather_cache.json. That exposes local-identifying information unnecessarily; request that caching avoid embedding host identity or make caching optional and opt-in. - Aggregator trust: The skill directs all traffic to api.openmeteo-api.com (an aggregator) rather than directly to open-meteo.com. Verify the operator (ownership, privacy policy, and hosting) before routing user location queries through it. You can test the endpoint manually as recommended in SKILL.md to confirm responses. - Workspace sharing risk: If your OpenClaw workspace is shared across instances or users, storing caches there could leak locations and host identities. Consider disabling caching or configuring a private cache path. If the maintainer can (1) remove the requirement to embed username/machine name in cache files, (2) clarify the caching policy and ensure it doesn't contradict the privacy claims, and (3) document operator identity/hosting clearly, the skill would be much more acceptable. If you cannot get satisfactory answers, prefer calling the upstream open-meteo API directly or use a different weather skill.
VirusTotal
No VirusTotal findings
Static analysis
No suspicious patterns detected.