ClawHub

Japan Seasons API

v1.0.0

Query Japanese seasonal data — cherry blossom forecasts, autumn foliage tracking, and festival search. Use when a user asks about sakura bloom dates, best ti...

⭐ 0· 54·0 current·0 all-time
byKo Syun / Gu Jun@ko-syun
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The SKILL.md documents endpoints for sakura, kouyou, and matsuri on https://jpseasons.dokos.dev which matches the skill's name and description. However, the registry metadata lists no required env vars or primary credential while the runtime instructions explicitly require an X-API-Key; this metadata omission is inconsistent.
✓
Instruction Scope
Instructions are narrow and consistent: call the documented API endpoints (via web_fetch or curl), parse JSON, and present results to the user. The instructions do reference an environment variable ($KEY) or passing the key in headers, which is expected for this API.
✓
Install Mechanism
No install spec and no code files — instruction-only skills have minimal disk footprint and nothing is downloaded or executed by default beyond normal network calls.
ℹ
Credentials
The SKILL.md requires a per-user API key (X-API-Key) from jpseasons.dokos.dev, which is appropriate for this purpose. The registry metadata, however, does not declare any required env vars or primary credential; this mismatch should be resolved so users know what secrets to supply.
✓
Persistence & Privilege
The skill does not request persistent presence (always is false), does not modify other skills or system config, and does not declare writing to disk. Autonomous invocation is allowed (platform default) but is not combined with other concerning privileges.
Assessment
This skill is coherent: it calls a third‑party API that requires an X-API-Key. Before installing, confirm the registry metadata is updated to declare the API key requirement (so the platform can surface the secret prompt), and only provide a key you trust to the jpseasons.dokos.dev service. Be aware the agent will make outbound HTTP requests (curl or web_fetch) to that domain and is subject to the service's rate limits (free tier 100/day). If you need stronger privacy, consider using a dedicated key with limited scope or rate limits, and verify the jpseasons.dokos.dev domain and dashboard are legitimate.

Like a lobster shell, security has layers — review code before you run it.

latestvk9783ammsm3y3t22kfpxbp8n6h83v4j5

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments