Go Stargazing

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This skill appears aligned with stargazing weather recommendations, with only setup/provenance notes around local Python dependencies and disclosed Open-Meteo weather queries.

Before installing, be comfortable with running a local Python-based skill that uses third-party Python packages and contacts Open-Meteo for forecast data. Treat its results as regional planning guidance, not exact site-level safety or astronomy measurements.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Requests for regions and dates may be sent to Open-Meteo to fetch forecast data, and large scans may consume API quota.

Why it was flagged

The skill explicitly relies on an external weather API, including potentially broad nationwide scans; this is expected for real weather recommendations but is still an external API data flow users should notice.

Skill content
天气主源:Open-Meteo HTTP API
Recommendation

Use it for non-sensitive trip-planning queries, and expect the skill to report failures or rate-limit conditions instead of inventing weather data.

What this means

Future installs could pull newer dependency versions with different behavior or vulnerabilities.

Why it was flagged

The Python dependencies are listed without pinned versions, so installation may resolve different package versions over time; these packages are purpose-aligned for lunar/geospatial calculations.

Skill content
lunarcalendar
shapely
Recommendation

Install from a trusted Python environment and consider pinning or reviewing dependency versions if using this skill in a controlled setup.

What this means

Version mismatch can make it harder to confirm exactly which package revision is being reviewed or installed.

Why it was flagged

The bundled metadata version differs from the registry version shown as 1.4.2, which is a minor provenance/version-label consistency issue.

Skill content
"version": "1.3.9"
Recommendation

Verify the publisher/package version before relying on it in an automated workflow.