Weather 1.0.0

PassAudited by ClawScan on May 1, 2026.

Overview

This is a simple weather lookup skill that uses public weather APIs, with only minor privacy and HTTPS-use notes.

This skill appears safe and purpose-aligned. Before using it, remember that weather locations are sent to wttr.in or Open-Meteo, and prefer adding `https://` to wttr.in URLs.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

A city name, airport code, or coordinates used in a query may be visible to the external weather service.

Why it was flagged

The skill sends location coordinates to an external weather provider; this is expected for the purpose, but users should understand the data leaves their environment.

Skill content

curl -s "https://api.open-meteo.com/v1/forecast?latitude=51.5&longitude=-0.12&current_weather=true"

Recommendation

Use only locations you are comfortable sending to the weather provider, and avoid sharing unnecessarily precise coordinates if approximate weather is sufficient.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A network observer could potentially see or modify a wttr.in query or response if it is made over unencrypted HTTP.

Why it was flagged

The primary wttr.in examples use curl with a scheme-less URL; if run as written, this may default to plaintext HTTP rather than explicitly using HTTPS.

Skill content

curl -s "wttr.in/London?format=3"

Recommendation

Prefer explicit HTTPS URLs, such as `https://wttr.in/London?format=3`, when using the wttr.in examples.