Weather
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a normal weather lookup skill that uses disclosed weather APIs and does not request credentials, persistence, or privileged access.
This skill looks appropriate for checking weather. Install it if you are comfortable with your queried city or coordinates being sent to public weather APIs, and verify the runtime/dependency expectations because the metadata only declares curl while the package includes JavaScript CLI files.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The city or coordinates you ask about may be visible to weather API providers.
The skill sends the requested location to an external weather API; this is expected for weather lookup, but it is still a third-party data flow.
const url = `${this.base}/${encodeURIComponent(location)}?format=${format}`; const res = await fetch(url);Use general city names instead of precise private coordinates if you are sensitive about location privacy.
Installation or execution may depend on runtime details not fully captured by the registry requirements.
The package also includes runnable JavaScript files and documentation comments referencing npm/node usage, so the runtime expectations are not fully reflected in the install metadata.
No install spec — this is an instruction-only skill.
Before installing, verify how the skill will be invoked and whether any Node/package dependencies are required in your environment.