Weather Query
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears narrowly focused on weather lookups, with the main cautions being that it sends location queries to a third-party weather API and relies on local shell/curl execution.
Before installing, be aware that weather locations you query are sent to https://60s.viki.moe and that the skill depends on local bash/curl despite not declaring required binaries. The provided code is small and purpose-aligned, with no evidence of credential access, persistence, or destructive behavior.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Weather locations the user asks about may be visible to the external API provider.
The user's city or district query is sent to a third-party weather API. This is purpose-aligned and uses HTTPS, but it means the location query leaves the local environment.
API_URL="https://60s.viki.moe/v2/weather" ... CURL_CMD=(curl -s -G "$API_URL" --data-urlencode "query=$QUERY")
Use the skill for ordinary weather lookups and avoid adding sensitive personal details to the location query; document the API provider clearly.
The skill may not work on systems without bash/curl, and users have limited provenance information beyond the included source files.
The helper is a shell script that invokes curl, while the provided requirements declare no required binaries and no install spec. This is a dependency/provenance hygiene issue, not evidence of hidden behavior.
#!/bin/bash ... CURL_CMD=(curl -s -G "$API_URL" --data-urlencode "query=$QUERY")
Declare bash/curl and the network API dependency in metadata, and provide clearer source or homepage provenance.