Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Weather Search

v1.0.0

Query real-time weather information using Amap (高德地图) Weather API. Use when user asks about weather, temperature, wind, humidity for Chinese cities. Requires...

0· 98·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for george-china/weather-search.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Weather Search" (george-china/weather-search) from ClawHub.
Skill page: https://clawhub.ai/george-china/weather-search
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: curl
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install weather-search

ClawHub CLI

Package manager switcher

npx clawhub@latest install weather-search
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, SKILL.md, and weather.sh consistently implement queries to Amap's weather REST API — that capability aligns with the stated purpose. However, the registry metadata lists no required environment variables or primary credential while the SKILL.md and weather.sh clearly require an AMAP_API_KEY, which is an incoherence in the manifest.
Instruction Scope
Runtime instructions and the script are narrowly scoped to building a curl request to restapi.amap.com and formatting the JSON. They do not read unrelated files or contact unexpected endpoints. Operational/privacy note: examples and the script embed the API key in the request URL which can expose the key in shell history, command logs, or process listings on multi-user systems.
Install Mechanism
Instruction-only skill with one small included script and no install spec — nothing is downloaded or executed during install. Risk from install mechanism is low.
!
Credentials
The only sensitive credential actually required is AMAP_API_KEY, which is proportionate to the functionality. However the registry metadata omitted declaring this required env var / primary credential; that mismatch is concerning because automated permission prompts or policy checks may not surface the need for the key. No other unrelated credentials are requested.
Persistence & Privilege
No elevated privileges requested. always is false, the skill does not declare permanent system presence, and it does not modify other skills or system configuration.
What to consider before installing
This skill appears to do exactly what it claims — call Amap's REST weather API — but the package metadata failed to declare the required AMAP_API_KEY. Before installing: (1) verify the skill listing is updated to require AMAP_API_KEY (or be prepared to set the env var yourself); (2) avoid pasting your API key directly into command lines on shared systems (the examples put the key in the URL which may leak via history/ps); (3) run the included weather.sh in a sandbox or inspect it (it is short and readable) and restrict the API key to least-privilege / per-application keys if possible; (4) if you need stricter guarantees, ask the publisher to correct the manifest so automated tooling can surface the credential requirement.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Clawdis
Binscurl
latestvk97e0tj40mnm09keb232k6fren83c3e1
98downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Weather Search Skill

Query real-time weather information using Amap (高德地图) Weather API.

API Documentation

https://lbs.amap.com/api/javascript-api/guide/services/weather

Prerequisites

  1. Get Amap API Key

  2. Set Environment Variable

    export AMAP_API_KEY="your_api_key_here"
    

Usage

Query Weather by City Name

curl -X GET "https://restapi.amap.com/v3/weather/weatherInfo?city=BEIJING&key=YOUR_API_KEY&output=json"

Query Weather by City Code

curl -X GET "https://restapi.amap.com/v3/weather/weatherInfo?city=110000&key=YOUR_API_KEY&output=json"

Query Multiple Cities

curl -X GET "https://restapi.amap.com/v3/weather/weatherInfo?city=BEIJING|SHANGHAI|GUANGZHOU&key=YOUR_API_KEY&output=json"

Query by Coordinates (Latitude, Longitude)

curl -X GET "https://restapi.amap.com/v3/weather/weatherInfo?location=116.40,39.90&key=YOUR_API_KEY&output=json"

API Parameters

ParameterTypeRequiredDescription
cityStringYes (or location)City name or city code
locationStringYes (or city)Format: longitude,latitude
keyStringYesAmap API Key
outputStringNoResponse format: json or xml (default: json)

Response Example

{
  "status": "1",
  "infocode": "10000",
  "info": "Query Successful",
  "count": "1",
  "lives": [
    {
      "province": "Beijing",
      "city": "Beijing",
      "adcode": "110000",
      "weather": "Clear",
      "temperature": "25",
      "winddirection": "North",
      "windpower": "2",
      "humidity": "45",
      "reporttime": "2024-01-15 12:00:00"
    }
  ]
}

Quick Start Script

Create a weather query script:

#!/bin/bash
# weather.sh

API_KEY="${AMAP_API_KEY:-your_api_key_here}"
CITY="$1"

if [ -z "$CITY" ]; then
    echo "Usage: weather.sh <city_name_or_code>"
    exit 1
fi

curl -s "https://restapi.amap.com/v3/weather/weatherInfo?city=${CITY}&key=${API_KEY}&output=json" | jq '.'

Make it executable:

chmod +x weather.sh
./weather.sh BEIJING

City Code Reference

CityCode
Beijing110000
Shanghai310000
Guangzhou440100
Shenzhen440300
Hangzhou330100
Chengdu510100
Wuhan420100
Xi'an610100

Notes

  • API Key is required for all requests
  • Free tier: 1000 requests/day
  • Response includes: weather condition, temperature, wind direction, wind power, humidity
  • Supports both Chinese city names and city codes

Comments

Loading comments...