IQAir Air Quality

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears coherent and benign, but it uses your IQAir API key and sends location lookup requests to IQAir.

Install if you are comfortable setting IQAIR_API_KEY and sending air-quality location lookups to IQAir. Prefer a limited/free API key, monitor quota use, and avoid the --nearest option if you do not want IP-based location inference.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Using the skill will consume the user's IQAir API quota and relies on protecting the IQAir API key in the environment.

Why it was flagged

The script reads the user's IQAir API key from the environment and sends it to the IQAir API, which is expected for this integration but still uses a user credential and API quota.

Skill content

api_key = os.getenv("IQAIR_API_KEY") ... params["key"] = api_key ... url = f"https://api.airvisual.com/v2/{endpoint}?{urllib.parse.urlencode(params)}"

Recommendation

Use a limited-purpose IQAir API key, avoid sharing logs or environments that expose it, and rotate the key if it may have been disclosed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

If nearest-city mode is used, IQAir may infer an approximate location from the request IP; explicit city or coordinate queries also send that location to IQAir.

Why it was flagged

The documented nearest-city mode uses the API provider's IP-based geolocation, so the provider may process the caller's approximate location/IP context.

Skill content

Finds the nearest city based on IP geolocation: curl "https://api.airvisual.com/v2/nearest_city?key=YOUR_API_KEY"

Recommendation

Use explicit city names or coordinates when appropriate, and avoid nearest-city mode if IP-based location inference is a privacy concern.