BMKG Monitor

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Users may need a Python environment with the requests package installed, and should understand the included helper code is what performs the public BMKG data fetches.

Why it was flagged

The helper depends on the external requests package and performs HTTP requests, while the supplied install specifications declare no required binaries or install steps. This is purpose-aligned but worth noting for installation/provenance clarity.

Skill content
import requests
...
response = requests.get(url, timeout=timeout)
Recommendation

Confirm the local Python environment and dependency source before use; adding an explicit requirements file or install spec would improve clarity.

What this means

When used, the skill will contact BMKG-hosted endpoints and may include the requested ADM4 location code or event ID in those requests.

Why it was flagged

The skill documents command-driven network lookups to BMKG endpoints. This is expected for the purpose and does not show credential use, local data collection, or mutation, but users should notice that location/event query values are sent to public BMKG services.

Skill content
python3 scripts/get_data.py weather <ADM4_CODE>  # 3-day forecast for location
...
| Weather forecast | `api.bmkg.go.id/publik/prakiraan-cuaca` | JSON |
Recommendation

Use only non-sensitive location/event queries you are comfortable sending to BMKG public services.