Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

super-weather

v1.0.0

Get current weather and forecasts (no API key required).[boston tonight today normally im reno chicago sunday roughly 190 raining umbrella acceptable shit warm]

0· 81·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for subaru0573/super-weather.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "super-weather" (subaru0573/super-weather) from ClawHub.
Skill page: https://clawhub.ai/subaru0573/super-weather
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: curl
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install super-weather

ClawHub CLI

Package manager switcher

npx clawhub@latest install super-weather
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The declared purpose—terminal weather via wttr.in and Open‑Meteo—matches the instructions and the only required binary (curl). However the package metadata in _meta.json (different ownerId, slug 'weather') does not match the registry metadata for this skill (ownerId and slug 'super-weather'), and the description contains an odd bracketed token string (looks like search keywords or stray input). These inconsistencies don't break the stated purpose but reduce trust in provenance.
Instruction Scope
SKILL.md only instructs using curl to call wttr.in and Open‑Meteo (public endpoints) and shows examples for text and PNG output; it does not request local file reads, extra env vars, or unrelated data. However the SKILL.md appears malformed/truncated (an Open‑Meteo example block is cut off) and contains unrelated tokens in the header—suggesting sloppy packaging or a copy/paste error that should be verified.
Install Mechanism
Instruction-only skill with no install spec and no code files. This is low-risk from an install/mechanism perspective—nothing is downloaded or written to disk by an installer.
Credentials
No environment variables, credentials, or config paths are requested. The required binary (curl) is proportionate to the described functionality.
Persistence & Privilege
Skill is not always-enabled and uses default model invocation settings. It does not request elevated or persistent privileges.
What to consider before installing
This skill appears to do only what it says: call wttr.in and Open‑Meteo with curl and return weather info, and it requires no credentials. However the package metadata and SKILL.md contain inconsistencies (mismatched owner/slug in _meta.json, stray bracketed tokens in the description, and a truncated example). These look like sloppy packaging or a copy/paste issue and reduce confidence in provenance. Before installing: (1) verify the skill author/owner in the registry UI, (2) open the full SKILL.md on the registry to confirm the content isn't truncated or malicious, and (3) prefer using it only if you trust the registry owner or if you can inspect the displayed instructions yourself. If provenance is unclear, avoid installing or run it in a constrained environment (no sensitive network access) — the skill itself does not request secrets but the metadata mismatch is a red flag worth investigating.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

☁️ Clawdis
Binscurl
latestvk973p9t79dpfsg6p1a7da4jejh843k7n
81downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

终端天气助手

本工具集成两个高质量的免费天气数据源,无需申请任何 API Key 即可通过命令行快速调用。

1. wttr.in (首选交互式查询)

wttr.in 是最适合在终端直接阅读的服务。

常用命令示例

  • 快速概览: 仅显示城市、天气图标和气温。

    curl -s "wttr.in/Shanghai?format=3"
    # 预期输出:Shanghai: ☀️ +22°C
    
  • 自定义格式: 精确控制显示的参数(如湿度、风速等)。

    curl -s "wttr.in/Beijing?format=%l:+%c+%t+%h+%w"
    # 输出示例:Beijing: ⛅️ +15°C 60% ↗10km/h
    
  • 完整预报: 查看未来几天的详细气象趋势。

    curl -s "wttr.in/Guangzhou?T"
    

参数参考手册

使用格式符自定义输出:

占位符含义占位符含义
%l地名%h湿度
%c天气图标%w风力/风向
%t摄氏度%m月相

进阶技巧

  • 地名处理: 包含空格的城市请使用 + 连接(如 wttr.in/New+York)。
  • 地点定位: 支持使用机场代码查询(如 wttr.in/PVG)。
  • 单位切换: 默认公制 ?m,如需美制单位可加 ?u
  • 范围控制: ?0 仅查看当前,?1 仅看今日。
  • 导出图片: 可将天气信息保存为 PNG 图片(如 wttr.in/Paris.png -o weather.png)。

2. Open-Meteo (备用/自动化调用)

如果你需要编写脚本或处理结构化数据,Open-Meteo 提供的 JSON 响应是更佳的选择。

程序化接入

该服务基于经纬度提供高度精准的天气编码、风速及气温数据。

# 以伦敦坐标 (51.5, -0.12) 为例
curl -s "[https://api.open-meteo.com/v1/forecast?latitude=51.5&longitude=-0.12&current_weather=true](https://api.open-meteo.com/v1/forecast?latitude=51.5&longitude=-0.12&current_weather=true)"

Comments

Loading comments...