Swiss-Weather

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears benign: it fetches public Swiss weather data from MeteoSwiss, with minor notices about outbound weather queries and a manually installed Python dependency.

This skill is reasonable for Swiss weather lookups. Be aware that forecast postal codes are sent to MeteoSwiss, and if you use the Python scripts you may need to install the requests package from a trusted source.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Postal-code forecast queries are sent to an external MeteoSwiss service.

Why it was flagged

Forecast lookups send the requested Swiss postal code to a MeteoSwiss endpoint. This is disclosed and central to the skill's purpose, and the artifacts do not show credentials or local files being sent.

Skill content

FORECAST_URL = "https://app-prod-ws.meteoswiss-app.ch/v1/plzDetail?plz={plz:06d}"

Recommendation

Use the skill for Swiss weather queries when you are comfortable sharing the queried postal code with MeteoSwiss.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If using the Python scripts, the user may install an external package into their environment.

Why it was flagged

The Python scripts require the third-party requests package, and the documentation gives an unpinned manual install command rather than a reviewed install spec. This is purpose-aligned but leaves package trust/version control to the user.

Skill content

## Dependencies

```bash
pip3 install requests
```

Recommendation

Install requests from a trusted package source or use a pinned/managed environment if supply-chain control matters.