← Back to Skills Marketplace
147
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install weather-ultra
Description
天气查询，含空气质量、日出日落、Golden/Blue Hour、朝霞晚霞预测。触发词：天气、天气预报、几点日落、霞光、朝霞、晚霞、golden hour、blue hour。适合摄影师和户外活动规划。
Usage Guidance
What to consider before installing:
- The included script needs two API keys (WEATHERAPI_KEY and SUNSETHUE_KEY) but the skill metadata did not declare them — confirm you are asked to provide only those keys and that you trust the endpoints (weatherapi.com and api.sunsethue.com).
- The script sources ~/.openclaw/.env (runs it as shell code). That means any commands in that file will be executed. Inspect the file before use and avoid placing unrelated secrets or commands there. Prefer providing just the two API keys in a safe, minimal file or environment rather than leaving a file with arbitrary content in ~/.openclaw/.env.
- The script embeds API keys in GET query strings; this can expose keys in logs or network traces. If you must use keys, consider using a dedicated key with limited scope or ask the maintainer to use POST or Authorization headers.
- The script assumes curl and jq are installed but the skill did not declare these dependencies; install them or request the author to declare requirements.
If you are not comfortable: do not install or run the script until the author updates the skill metadata to declare required env vars, removes unsafe 'source' behavior (or documents it clearly), and documents dependencies. If you proceed, review ~/.openclaw/.env contents and limit the provided API keys to only what is needed.
Capability Analysis
Type: OpenClaw Skill
Name: weather-ultra
Version: 1.0.0
The skill provides weather and photography-related lighting data by querying external APIs (api.weatherapi.com and api.sunsethue.com). It is classified as suspicious because the script `scripts/weather-full.sh` lacks input sanitization for the `CITY` and `DAYS` arguments, which are used directly within a `curl` command. This creates a shell injection vulnerability where a crafted input (e.g., using backticks or command substitution) could lead to arbitrary code execution. No evidence of intentional malice or data exfiltration was found.
Capability Assessment
Purpose & Capability
The script performs weather and sunrise/sunset/quality queries (WeatherAPI and sunsethue) which match the skill's description. However the skill metadata declared no required environment variables or credentials while the script expects WEATHERAPI_KEY and SUNSETHUE_KEY — an incoherence between claimed requirements and actual needs.
Instruction Scope
The runtime script sources ~/.openclaw/.env if present (using shell source), which executes any code in that file rather than just reading key/value pairs. That grants the skill the ability to run arbitrary commands from a user file without explicit declaration. Otherwise the script's network calls go only to weatherapi.com and api.sunsethue.com which are consistent with purpose.
Install Mechanism
This is instruction-only with a bundled shell script (no installer). The script assumes presence of curl and jq but the registry lists no required binaries; missing these will cause runtime errors. No downloads or external install URLs are used.
Credentials
The script relies on two API keys (WEATHERAPI_KEY and SUNSETHUE_KEY) which are proportional to the functionality, but they are not declared in the skill metadata. More importantly, sourcing ~/.openclaw/.env may expose unrelated secrets or execute arbitrary content — a disproportionate access pattern relative to the stated purpose.
Persistence & Privilege
The skill does not request persistent/autonomous elevation (always:false) and does not modify system or other skills' config. It runs as an on-demand script, so persistence/privilege level is appropriate.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install weather-ultra - After installation, invoke the skill by name or use
/weather-ultra - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: 天气查询 + 朝霞晚霞预测 + Golden/Blue Hour
Metadata
Frequently Asked Questions
What is Weather Ultra?
天气查询，含空气质量、日出日落、Golden/Blue Hour、朝霞晚霞预测。触发词：天气、天气预报、几点日落、霞光、朝霞、晚霞、golden hour、blue hour。适合摄影师和户外活动规划。 It is an AI Agent Skill for Claude Code / OpenClaw, with 147 downloads so far.
How do I install Weather Ultra?
Run "/install weather-ultra" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Weather Ultra free?
Yes, Weather Ultra is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Weather Ultra support?
Weather Ultra is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Weather Ultra?
It is built and maintained by Pazzilivo (@pazzilivo); the current version is v1.0.0.
More Skills