Weather Cli

PassAudited by ClawScan on May 1, 2026.

Overview

This is a simple weather-lookup skill using a public weather service, with only a minor note that its documented command/dependencies are not backed by an install spec or bundled code.

This appears safe for ordinary weather lookups. Before installing or using it, confirm where the `weather` command comes from and only run the suggested curl/jq installation if you trust your system package manager and are comfortable modifying your local environment.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may not work until the user separately installs the required tools or provides the missing weather command; running the package install command changes the local system package set.

Why it was flagged

The skill documents local dependencies and a `weather` command, but the supplied artifacts have no install spec or bundled command implementation. This is disclosed, user-directed setup, but users should not assume the CLI wrapper is provided by the skill.

Skill content

确保已安装 `curl` 和 `jq`：
```bash
apt-get install -y curl jq  # Debian/Ubuntu
```
...
weather Beijing

Recommendation

Install dependencies only from trusted OS package sources, verify what provides the `weather` command before invoking it, and avoid granting unnecessary privileges.