41/100 (Medium)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： unknown

OpenClaw： suspicious

The skill is what it claims (a curl/grep-based Chinese weather script) but the included shell script unsafely evals parsed HTML content, creating a realistic risk of command injection if fetched pages...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： unknown

README 未提供

{
    "latestVersion": {
        "_creationTime": 1770949077938,
        "_id": "k97a4z5zkvhvvdvge7b7xmyf218120j9",
        "changelog": "- 更新使用示例中的脚本路径为用户主目录下的标准路径，提升通用性\n- 其余内容保持不变，无代码或功能变动",
        "changelogSource": "user",
        "createdAt": 1770949077938,
        "parsed": {
            "clawdis": {
                "emoji": "🌤️",
                "requires": {
                    "bins": [
                        "curl",
                        "grep"
                    ]
                }
            }
        },
        "version": "1.0.1"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "kenera",
        "handle": "kenera",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/25951063?v=4",
        "kind": "user",
        "linkedUserId": "kn7d0t69ynpqg1qtn0w6x7pn9x812dvd"
    },
    "ownerHandle": "kenera",
    "skill": {
        "_creationTime": 1770948592300,
        "_id": "kd73mhm3tsx40h8pdf2rrw2hnx812s7v",
        "badges": [],
        "createdAt": 1770948592300,
        "displayName": "中国城市天气Weather in China",
        "latestVersionId": "k97a4z5zkvhvvdvge7b7xmyf218120j9",
        "ownerUserId": "kn7d0t69ynpqg1qtn0w6x7pn9x812dvd",
        "slug": "weather-cn",
        "stats": {
            "comments": 0,
            "downloads": 1572,
            "installsAllTime": 21,
            "installsCurrent": 20,
            "stars": 3,
            "versions": 2
        },
        "summary": "中文天气查询工具 - 使用中国天气网获取实时天气（无需API密钥，不依赖大模型）",
        "tags": {
            "latest": "k97a4z5zkvhvvdvge7b7xmyf218120j9"
        },
        "updatedAt": 1774324437938
    }
}