和风天气查询功能

天气查询：使用和风天气（JWT+Host）获取实时天气与未来预报；支持城市名/LocationID/经纬度；缺省地点可用 QWEATHER_DEFAULT_LOCATION。

Security Scan

The skill implements a QWeather-based weather client (coherent with its name) but its code requires private-key-backed JWT credentials and environment variables that are not declared in the metadata, and the package contains a suspicious private-key text file placeholder — these mismatches warrant caution.

Purpose & Capability

The skill's code and SKILL.md implement weather lookups via QWeather (and fallbacks to Open-Meteo), which matches the declared purpose. However, the implementation expects a QWeather JWT flow (PROJECT_ID, CREDENTIALS_ID, PRIVATE_KEY_PATH, API_HOST) but the registry metadata lists no required env vars/credentials. That mismatch (hidden/undeclared credentials) is unexpected for a simple weather skill.

Instruction Scope

SKILL.md instructs the agent to use the bundled tools (location lookup, now, forecast) and references env vars such as QWEATHER_DEFAULT_LOCATION and QWEATHER_PRIVATE_KEY_PATH. The code reads a private key file (CONFIG.PRIVATE_KEY_PATH) from disk, signs JWTs, and calls external APIs. The instructions are not overly broad, but they rely on reading local key material and several environment variables that are not declared in the skill metadata — this expands the runtime surface without making that explicit.

Install Mechanism

There is no install spec and no downloads. The skill is instruction+code only and uses standard Node libraries (crypto, axios). No external installers or remote archives are used.

Credentials

The code requires private key material and QWeather credentials (PROJECT_ID, CREDENTIALS_ID, PRIVATE_KEY_PATH, API_HOST) to use the enterprise JWT-backed API, and also checks process.env.QWEATHER_FREE_API_KEY and QWEATHER_DEFAULT_LOCATION in fallback code. None of these are declared in the skill's required env/credential metadata. Additionally the repo includes lib/ed25519-private.txt which does not contain a key but an openssl command wrapped in PEM markers — its presence is unusual and could be a placeholder or a mistaken checked-in secret. Requiring private keys or API keys without declaring them is disproportionate and surprising to users.

Persistence & Privilege

always is false and there is no code that attempts to modify other skills or global agent settings. The skill does read files from its own package (the configured PRIVATE_KEY_PATH) but does not request persistent system privileges.

What to consider before installing

This skill mostly does what it says (weather lookups), but it expects enterprise-style JWT credentials and a private key while the registry metadata declares no required secrets. Before installing, ask the author to: 1) explicitly list required env vars and the primary credential in the registry (PROJECT_ID, CREDENTIALS_ID, QWEATHER_PRIVATE_KEY_PATH or QWEATHER_API_HOST); 2) remove any checked-in private key files (or confirm the file is only a harmless placeholder) and instead require the private key path be provided via a secure env var or secret store; 3) confirm the API_HOST and other config are not hard-coded placeholders; and 4) document why QWEATHER_FREE_API_KEY and QWEATHER_DEFAULT_LOCATION are needed. If you cannot verify those, avoid installing or running the skill with real credentials on sensitive systems.

目标

• 给用户提供可靠的实时天气与预报（不依赖通用 web_search）。
• 自动处理地点输入（城市名/经纬度/locationId）。
• 支持“今天/明天/后天/未来N天”等表达。

触发条件

• 用户提到：天气、气温、下雨、降温、风、湿度、预报、今天/明天/后天、未来几天。
• 一旦判定是天气问题，优先本 skill。

工作流

1. 获取地点

• 若用户提供地点：调用 qweather_location_lookup({location})
• 若未提供地点：
  • 若 env 存在 QWEATHER_DEFAULT_LOCATION：使用默认地点，并明确说明“按默认地点查询”
  • 否则追问用户城市/地点

2. 判断查询类型

• “现在/当前/实时”：调用 weather_now({location})
• “今天/明天/后天/未来N天”：调用 weather_forecast({location, days})

建议 days 映射：

• 今天：days=1
• 明天：days=2（输出前2天，重点标明第2天）
• 后天：days=3（重点标明第3天）
• “未来几天”：默认 days=3；用户说 N 天则用 N（上限 15）

3. 输出格式

• 地点（解析后的 name）
• 实时：天气现象、气温/体感、湿度、风向风力、观测时间
• 预报：每天最高/最低、白天/夜间天气、降水（如有）、风力

约束

• 不要使用 web_search 代替天气数据源。
• API 失败时：返回明确错误，并提示检查 env：
  • QWEATHER_API_HOST / QWEATHER_PROJECT_ID / QWEATHER_CREDENTIALS_ID / QWEATHER_PRIVATE_KEY_PATH
  • 或使用 QWEATHER_DEFAULT_LOCATION 设置默认查询地点