QWeather City Weather

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent may run the included script to perform weather lookups.

Why it was flagged

The skill is designed around running a local Python script. This is expected for the stated purpose, but users should understand that invoking the skill runs bundled code.

Skill content

Use this skill primarily via the bundled script:

- `scripts/qweather_query.py`

Recommendation

Use the skill only if you are comfortable with the bundled script being run for QWeather city and weather queries.

Note

ASI03: Identity and Privilege Abuse

What this means

A QWeather API key is needed, and it will be sent to whatever QWEATHER_API_HOST or --api-host value is configured.

Why it was flagged

The script sends the provided QWeather API key as an HTTP header to the configured API host. This is expected for QWeather API access, but it is still credential use.

Skill content

"X-QW-Api-Key": api_key

Recommendation

Set the API host only to an official/trusted QWeather endpoint and avoid exposing the API key in shared logs or prompts.