Tempest Weather
v1.1.0Get current weather conditions from a WeatherFlow Tempest station using the Tempest REST API. Use when the user asks for "tempest weather" (preferred trigger...
⭐ 0· 880·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, README, SKILL.md, and the Python script all align: the skill queries WeatherFlow/Tempest REST endpoints using an API token and a station or device id. The only mismatch is registry metadata listing TEMPEST_STATION_ID and TEMPEST_DEVICE_ID as required even though the code accepts either one (device takes precedence) and SKILL.md documents them as optional alternatives. TEMPEST_UNITS is also declared required in metadata but the script treats it as optional (default 'us').
Instruction Scope
SKILL.md instructs running python3 scripts/get_tempest_weather.py and the script reads only the declared env vars and calls the documented Tempest endpoints. There is no instruction to read unrelated system files, other credentials, or to transmit data to any endpoints other than the WeatherFlow API. The script does read SKILL.md (to detect a version string) which is benign and scoped to the skill.
Install Mechanism
No install spec or external downloads are present; this is effectively an instruction/script bundle. All code is included in the skill archive and no network-based install or arbitrary URL extraction is used.
Credentials
Requested credential (TEMPEST_API_TOKEN) is appropriate and used as the primary credential. However, the registry's required env list includes TEMPEST_STATION_ID, TEMPEST_DEVICE_ID, and TEMPEST_UNITS even though the script treats station/device as optional alternatives and units as optional with a default. This is an overbroad metadata declaration but not evidence of exfiltration or unrelated credential access.
Persistence & Privilege
The skill does not request always: true and has no special OS or config-path requirements. It does not modify other skills or system-wide settings. Normal autonomous invocation is allowed (platform default) but nothing in the skill increases privilege.
Assessment
This skill appears to be what it says: a small Python script that calls WeatherFlow/Tempest REST endpoints and formats results. Before installing, confirm you are comfortable providing a Tempest API token and one of station or device IDs to the skill (the token is the only sensitive secret required). Note the registry metadata over-declares required env vars (it lists both station and device IDs and units as required even though the code accepts either station OR device and defaults units to 'us') — you only need to set the token and at least one of station/device. Review the included scripts (get_tempest_weather.py) yourself if you want additional assurance, and do not hardcode the token in files; keep it in environment variables. If you need stricter guarantees, run the included tests locally to verify behavior before use.Like a lobster shell, security has layers — review code before you run it.
latestvk97ahjey26xp2kvnp71tm58ycx81pjrptempestvk97fhejrwkx5dym1kce89fs7qd811qbfweathervk97fhejrwkx5dym1kce89fs7qd811qbf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Any binpython3
EnvTEMPEST_API_TOKEN, TEMPEST_STATION_ID, TEMPEST_DEVICE_ID, TEMPEST_UNITS
Primary envTEMPEST_API_TOKEN