KnowAir Minutely 明气分钟级降水

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to do what it claims: query Caiyun’s weather API for short-term precipitation forecasts using a user-provided API token and coordinates.

Before installing, confirm you are comfortable giving the skill access to a Caiyun API token and sending queried coordinates to Caiyun’s API. The included code is small and purpose-aligned, with no evidence of hidden persistence, destructive actions, or unrelated data access.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may run a local Python command to call the weather API.

Why it was flagged

The skill permits Python commands through Bash, which is needed to run the included weather-query script but is broader than a single fixed command.

Skill content

allowed-tools: ["Bash(python3:*)", "Read"]

Recommendation

Use it for the documented script invocation and review any unexpected Python command before allowing it.

Low

#ASI03: Identity and Privilege Abuse

What this means

Your Caiyun API token and requested coordinates are sent to Caiyun to retrieve the forecast.

Why it was flagged

The script reads a Caiyun API token from the environment or a clearly named local config file and uses it to authenticate to the Caiyun API.

Skill content

token = os.environ.get("CAIYUN_TOKEN") ... config_path = os.path.expanduser("~/.config/knowair/token") ... url = f"{API_BASE}/{token}/{args.lng},{args.lat}/minutely?lang={args.lang}"

Recommendation

Provide a token intended for Caiyun Weather API use, and avoid using the skill for locations you do not want sent to that provider.