qweather

• Analyzed: May 11, 2026, 6:15 AM
• Findings: 1
• Version: 1.0.0
• Hash: 2e2582316d9d522f0cce4a4fe72fbbb37bbb030bc5bfd8aca87bb152ff262c37
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a legitimate implementation for querying weather data via the QWeather (和风天气) API. It follows a standard CLI structure, implementing city lookup, real-time weather, forecasts, and life indices. Security analysis shows proper input validation in `scripts/lib/validators.ts`, safe HTTP request handling in `scripts/lib/http.ts`, and no evidence of data exfiltration, unauthorized execution, or malicious prompt injection in `SKILL.md`. The use of environment variables for API keys and hosts is consistent with the service's requirements.