BirdWeather
PassAudited by ClawScan on May 1, 2026.
Overview
The skill appears to be a straightforward public BirdWeather API query tool, with minor notes about outbound API requests and limited source provenance.
This looks safe for normal public BirdWeather station queries. Before installing, note that it contacts app.birdweather.com and the registry does not provide a source repository or homepage.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
BirdWeather can see the station IDs and query parameters used, but no credentials or local files are sent by the artifacted code.
The tool sends user-selected station and query parameters to BirdWeather's public API. This is expected for the skill's purpose and does not show unrelated network use.
API_BASE = "https://app.birdweather.com/api/v1" ... urllib.request.urlopen(req, timeout=TIMEOUT)
Use it for public BirdWeather station lookups; avoid querying stations or locations you consider sensitive.
Users have less external provenance information to verify the publisher or upstream project.
The registry metadata does not identify an upstream source or project homepage. The included code is small and stdlib-only, so this is a provenance note rather than a behavioral concern.
Source: unknown Homepage: none
Review the included script before installing and prefer a known source if provenance is important to your environment.