Pollen Forecast 花粉播报

Security checks across malware telemetry and agentic risk

Overview

This skill provides pollen forecasts and optional daily alerts, with the main caveat that scheduled alerts should only be enabled deliberately.

Install is reasonable for pollen forecasts. Before enabling daily alerts, confirm the city, timezone, schedule, destination channel, and recipient, and make sure you know how to list or delete the OpenClaw cron job later.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to create a persistent scheduled task via `openclaw cron add` without explicitly requiring informed user consent, clarifying that the action is ongoing, or describing how to review/remove it later. In an agent setting, this can cause unintended persistent automation, repeated outbound messages, and surprise system modification beyond the user's immediate request.

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal