Shuzhi Weather

This skill should be used when users need to query weather information via the Shuzhi Weather API with HMAC-SHA256 authentication. It provides hourly weather...

This skill appears to do what it says: it posts HMAC-SHA256-signed requests to the Shuzhi Weather API and needs an app_key and app_secret. Before installing, consider: (1) Verify you trust the API host (https://test-apisix-gateway.shuzhi.shuqinkeji.cn) because your credentials will be sent to that endpoint. (2) Store credentials securely — the script expects plaintext JSON at ~/.openclaw/skills/shuzhi-weather/config.json; consider filesystem permissions or an alternative secret store if your platform supports it. (3) Note the SKILL.md claims an environment-variable fallback that the script does not implement — if you need env var support, ask the author or modify the script. (4) The agent will run the included Python script which performs network requests; if you have network egress policies, ensure this host is allowed. If you want extra assurance, inspect the config file location, the API domain ownership, or run the script in a restricted environment first.

Type: OpenClaw Skill Name: shuzhi-weather Version: 1.0.0 The shuzhi-weather skill is a legitimate tool for fetching weather data from the Shuzhi Weather API. It uses standard HMAC-SHA256 authentication and manages credentials securely in a skill-specific configuration file (~/.openclaw/skills/shuzhi-weather/config.json). The Python script (scripts/get_weather.py) uses the standard library for network requests and lacks any indicators of malicious intent, such as data exfiltration or unauthorized command execution.