Daily Greeting Bot

获取当地天气，并结合天气情况生成一句幽默的早安问候或“土味情话”。

Security Scan

Skill's behavior (fetch weather and build a greeting) is coherent, but the SKILL.md declares a required WEATHER_API_KEY and curl whereas the registry metadata lists no requirements and the skill's source is unknown—this packaging mismatch and missing provenance merit caution.

Purpose & Capability

The stated purpose (get local weather and produce a humorous greeting) matches the instructions in SKILL.md: it uses an API key (WEATHER_API_KEY) and curl to call a weather API. However, the registry metadata at the top of the package claims no required env vars or binaries while SKILL.md declares both; this inconsistency is a packaging/metadata issue that should be resolved.

Instruction Scope

Runtime instructions are narrowly scoped: ask user for city, call a weather API using curl and WEATHER_API_KEY, format a weather line plus greeting, and fallback to a generic greeting on errors. The instructions do not request unrelated files, system state, or additional credentials.

Install Mechanism

No install spec and no code files (instruction-only). That is low-risk: nothing is downloaded or written to disk by an installer. The security surface is the agent following the textual instructions.

Credentials

SKILL.md reasonably requires a single WEATHER_API_KEY and the curl binary. A single API key is proportional to the task. The concern is that the registry-level metadata omitted these requirements—users or the platform might not realize a secret is needed. Treat WEATHER_API_KEY as sensitive: ensure it is scoped to a weather service and not a reused high-privilege key.

Persistence & Privilege

Skill is not always-enabled and uses the default model-invocation ability. It does not request to modify other skills or system-wide settings and has no install-time persistence, so no elevated privileges are requested.

What to consider before installing

This skill's functionality is coherent and low-risk in principle, but the package metadata is inconsistent and the skill has no published source or homepage. Before installing: (1) Confirm which weather API vendor the skill expects and only provide a dedicated, limited-scope WEATHER_API_KEY (don’t reuse keys that access other services). (2) Verify that curl is available on the agent host. (3) Because the registry metadata omitted the required env var, expect to have to supply WEATHER_API_KEY manually; treat it as a secret. (4) If you need stronger assurance, ask the publisher for a source repo or manifest so you can verify there are no hidden commands or installers. (5) Test with a throwaway/limited API key first and monitor agent activity/logs. If you cannot verify the skill's provenance or cannot create a limited API key, avoid supplying any sensitive credentials.

身份设定

你是一个幽默、贴心的私人早安助手。你的任务是在每天早晨为用户提供当天的天气预报，并根据天气情况搭配一句应景的“土味情话”或幽默段子。

执行步骤

1. 获取天气：当用户触发你时，询问用户所在的城市。使用系统的 curl 工具和环境变量中的 WEATHER_API_KEY，调用天气 API 获取当天的气温和天气状况。
2. 构思文案：
   • 如果是晴天，说一些阳光、明媚的情话。
   • 如果是雨天，说一些关于撑伞、思念的段子。
3. 输出格式：
   • 🌡️ 今日天气：[天气状况]，[气温]
   • 💌 早安寄语：[你生成的幽默情话]

异常处理

如果无法获取天气数据（如网络错误或 API Key 无效），请委婉地告知用户，并直接送上一句不需要天气背景的通用早安祝福。