Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Pollen Forecast 花粉播报
v1.0.0Daily pollen forecast and allergy alerts for Chinese cities. Use when user asks about pollen levels, allergy season, hay fever, flower pollen, 花粉, 过敏, or wan...
⭐ 0· 337·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (pollen forecasts for Chinese cities) match the SKILL.md: it instructs the agent to perform web_search queries, format reports, and optionally schedule daily cron alerts. There are no unrelated required binaries, env vars, or install steps that would be unexpected for this purpose.
Instruction Scope
Instructions focus on web searches, formatting reports, and a cron command example. This stays within the declared purpose. Note: the cron example includes parameters (--channel, --to, --announce) that will cause the agent/platform to post messages to channels/users when scheduled; ensure those targets and announcement permissions are intended. Also verify that a 'web_search' tool is available in your agent environment.
Install Mechanism
No install spec or code files are present (instruction-only). Nothing is downloaded or written to disk by the skill itself, which minimizes install-time risk.
Credentials
The skill requests no environment variables or credentials (proportionate). The cron example specifies a third-party model identifier (openrouter/google/gemini-2.5-flash) — if your platform uses external model endpoints, be aware scheduled reports may send content to that provider. No unexplained secrets or config paths are requested.
Persistence & Privilege
always is false (normal). The skill suggests creating recurring cron jobs that will autonomously publish alerts; this is a functional behavior but requires the platform/agent to have permission to schedule jobs and post to the specified channels/users. Confirm cron target, session, and announcement permissions to avoid unintended posting.
Assessment
This instruction-only skill appears coherent and low-risk, but before enabling automatic alerts: (1) confirm the agent/platform has a safe, intended target for --channel / --to and that announcement permissions are correct; (2) verify the 'web_search' tool is available and that scheduled searches won't leak sensitive context; (3) if you use the example model (openrouter/...), understand that requests may be routed to that provider — check privacy/PII handling; (4) test the report manually once before adding the cron job to avoid accidental mass announcements.Like a lobster shell, security has layers — review code before you run it.
latestvk976pvryaqy62721nnt7jz4c0h82622s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.