天气查询测试技能

PassAudited by ClawScan on May 1, 2026.

Overview

This is a simple weather lookup skill that sends a recognized city name to a public weather API and shows no credential, file, persistence, or destructive behavior.

This skill appears safe for basic city weather queries. Be aware that the city name is sent to an external weather service over HTTP, so avoid using it for sensitive location-related requests.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

The queried city may be visible to the external weather service or network path, and the returned weather information could be modified in transit; no broader personal data is shown as being sent.

Why it was flagged

The code limits city extraction to a fixed list, then sends that city to wttr.in over plain HTTP for weather data. This matches the stated purpose, but users should know the query leaves the platform and is not sent over HTTPS.

Skill content

cities = ["北京", "上海", "广州", "深圳", "杭州", "成都", "重庆"] ... url = f"http://wttr.in/{city}?format=j1"

Recommendation

Use this only for nonsensitive weather lookups; the maintainer should prefer HTTPS and declare the external network dependency clearly in metadata.