和风天气查询功能

• Analyzed: May 16, 2026, 3:26 AM
• Findings: 1
• Version: 1.0.0
• Hash: efa1a83716c3cc6a29225a9c5e4ce39c32d602962d1385819b39968e62188fbc
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to query weather data using the QWeather API, which requires JWT authentication. This involves reading a private key from a file (`lib/ed25519-private.txt` is a template, but the code in `lib/qweather_jwt_session.js` and `lib/gen_qweather_token.js` uses `fs.readFileSync` to load it). While this file access is necessary for the skill's stated purpose of JWT signing, it represents a high-risk capability (direct access to a private key file) that could be exploited if the `PRIVATE_KEY_PATH` configuration were maliciously altered. Additionally, the `gen_qweather_token.js` utility script logs the generated JWT token to the console, which could be a minor information leak in certain environments.