Openweather Api
PassAudited by ClawScan on May 1, 2026.
Overview
The skill is a coherent OpenWeather integration, but users should notice that it relies on a globally installed Membrane CLI and Membrane-managed authentication.
This appears to be a normal Membrane-based OpenWeather integration. Before installing, be comfortable installing the Membrane CLI globally, logging into Membrane, and allowing Membrane to manage the OpenWeather connection credentials.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing a global CLI gives that package command-line execution capability on the user's machine.
The skill asks the user to install the Membrane CLI globally from npm using the latest version. This is a normal setup step for the stated Membrane-based integration, but it introduces dependency/provenance risk.
npm install -g @membranehq/cli@latest
Install only if you trust Membrane and npm package provenance; consider pinning or reviewing the CLI version in managed environments.
The integration may keep access to the connected Membrane/OpenWeather account so future weather API actions can run without repeated login.
The skill relies on Membrane-managed authentication and credential refresh for the OpenWeather connection. This is expected for an API integration, but users should recognize that credentials or delegated access are involved.
Membrane handles authentication and credentials refresh automatically
Use the intended Membrane account, review the created connection, and revoke it when no longer needed.
The agent can run OpenWeather-related API actions through Membrane, which may use account quota or reveal queried locations to the provider.
The skill documents running discovered Membrane actions against a specific connection. This fits the OpenWeather API purpose, but action execution is a broad integration mechanism.
membrane action run <actionId> --connectionId=CONNECTION_ID --input '{"key": "value"}' --jsonKeep actions scoped to the intended OpenWeather connection and review unusual or non-weather-related action requests before running them.