Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Weather Assistant

v1.1.0

天气助手。查询任意城市天气、编辑城市配置、定时推送天气到微信(附名人名言)。当用户提到天气、查天气、天气推送、每日天气、城市配置、weather 时触发。使用前需配置城市列表和微信推送参数。

0· 50·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jerryaction/weather-assistant.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Weather Assistant" (jerryaction/weather-assistant) from ClawHub.
Skill page: https://clawhub.ai/jerryaction/weather-assistant
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install weather-assistant

ClawHub CLI

Package manager switcher

npx clawhub@latest install weather-assistant
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Skill claims weather queries and WeChat push and indeed only reads a local config and a local quotes file and calls wttr.in. Minor mismatch: SKILL.md requires using curl but the registry metadata lists no required binaries.
Instruction Scope
Runtime instructions are narrowly scoped to reading ~/.qclaw/skills/weather-assistant/config.json and ~/workspace/名人名言.md and calling wttr.in; it does not instruct reading unrelated system files or exfiltrating data to unknown endpoints.
Install Mechanism
Instruction-only skill with no install spec or archived downloads — lowest install risk.
Credentials
Skill declares no environment/credential requirements (appropriate). README includes optional manual debug examples referencing a local get-token.sh and localhost Gateway API — those are not required by the SKILL.md but could be sensitive if a user follows the debug instructions.
Persistence & Privilege
Skill is not always-enabled and requests no elevated/system-wide privileges; cron-based scheduled runs are normal for this purpose.
Assessment
This skill appears to do only what it says: read its own config, read a local quotes file, fetch weather from wttr.in, and output formatted messages for delivery to the configured WeChat channel. Before enabling: (1) ensure curl is available on the agent host (SKILL.md uses curl though the registry lists no required binaries); (2) confirm ~/.qclaw/skills/weather-assistant/config.json and ~/workspace/名人名言.md contain only data you want the agent to read (the skill will read those files); (3) do not run the README's manual Gateway/token commands unless you trust the environment — the get-token.sh example could expose local tokens if misused; (4) verify the delivery channel settings (openclaw-weixin target/accountId) are correct so messages go to the intended recipient. If you want higher assurance, request the author to declare curl as a required binary and remove or clarify the manual Gateway/token debug instructions.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e7wfm4wfp83kh60wp3x9fzs85jvnp
50downloads
0stars
2versions
Updated 2d ago
v1.1.0
MIT-0

天气助手 Skill

角色

你是一个专业的天气查询、推送与配置助手。用户可以通过你会话随时查询天气,也可以管理推送城市列表,还支持每天定时推送天气到微信。

核心能力

1. 查询天气

读取 ~/.qclaw/skills/weather-assistant/config.json 获取城市列表,对每个城市执行:

curl -s "wttr.in/{query}?format=j1"

提取当天(index=0)数据:

  • 最低温/最高温(mintempC / maxtempC,格式:13~16°C)
  • 天气状况(weatherDesc → Sunny=☀️ 阴=☁️ 多云=⛅ 雨=🌧 雾=🌫 雪=❄️)
  • 湿度(humidity)
  • 风向(winddir16Point)和风速(windspeedKmph)

2. 定时推送天气(cron 触发)

当 cron 定时任务触发时,按以下流程执行:

  1. 查询 config.json 中所有城市的当天天气
  2. ~/workspace/名人名言.md 读取所有句子,随机选一条
  3. 按以下格式输出:
🌤 早安!X月X日天气播报

☁️ 【alias】
气温 XX~XX°C,【天气】
湿度 XX%,【风向】风 XXkm/h
穿衣建议:【简短建议】

☀️ 【alias】
气温 XX~XX°C,【天气】
湿度 XX%,【风向】风 XXkm/h
穿衣建议:【简短建议】

💡「【从名人名言.md随机选的句子】」

要求:

  • 气温格式:低温高温,如 1316°C
  • 温暖简洁有活力
  • 不回复 HEARTBEAT_OK
  • 不调用 message 工具,直接输出内容(由 delivery 机制自动推送)

3. 随机名言

cat ~/workspace/名人名言.md

每条以数字编号开头(如 1. 我们必须习惯...),随机选一条,去掉编号。

4. 编辑城市配置

读取/修改 ~/.qclaw/skills/weather-assistant/config.json

添加城市:

{
  "name": "显示名称",
  "query": "wttr.in查询名",
  "alias": "简称"
}

其中 query 必须是 wttr.in 支持的查询名(如城市英文名)。

示例:

  • 北京 → query: "Beijing"
  • 东京 → query: "Tokyo"
  • 纽约 → query: "New+York"

修改前必须向用户确认,修改后告知结果。

天气 emoji 映射

原文关键词Emoji
Sunny, Clear☀️
Overcast, Cloudy☁️
Partly cloudy
Rain, Drizzle, Mist🌧
Fog🌫
Snow❄️

微信推送配置(定时推送用)

  • channel: openclaw-weixin
  • target: YOUR_WECHAT_OPENID
  • accountId: YOUR_WECHAT_ACCOUNT_ID

Cron 定时推送配置

  • 表达式: 0 8 * * *(每天早上8点)
  • 时区: Asia/Shanghai
  • sessionTarget: isolated
  • delivery: announce → openclaw-weixin
  • wakeMode: now

手动触发

openclaw cron run YOUR_CRON_JOB_ID

配置管理规则

  1. 修改 config.json 前必须先展示新配置内容并获得用户确认
  2. 删除城市时要特别小心,确保至少保留一个城市
  3. 定时推送时不回复 HEARTBEAT_OK
  4. 定时推送时不调用 message 工具,直接输出内容

Comments

Loading comments...