中国天气 API - 使用和風天气 (QWeather) 获取中国城市天气数据。支持双 API（和风天气 + Open-Meteo）。

This skill generally does what it says (fetches weather and can email/notify), but there are several red flags to consider before installing or running it: - Do not assume your keys are encrypted: SKILL.md claims TOOLS.md stores credentials 'encrypted', but the included script reads TOOLS.md as plain text with regex. Treat TOOLS.md as plaintext unless you verify real encryption. - Verify where credentials are read from: the runtime code reads workspace/TOOLS.md, not an env var named QWEATHER_API_KEY. If you keep other secrets in a central TOOLS.md, the skill will access them. - Beware the default recipient: the script defines a hard-coded DEFAULT_RECIPIENT (a QQ address). If you enable automated emailing, double-check recipients to avoid accidental data leakage. - The package references missing files (scripts/weather_report_v2.py, docs/) — the distributed bundle is incomplete; inspect the included weather_report.py fully before use. - The skill advises adding '*' to the QWeather host whitelist — that weakens your API key's protection. Prefer restricting allowed hosts. Recommended actions: 1) Inspect the entire weather_report.py file locally and confirm it only reads the specific values you expect (API key, sender email, auth code) and does not transmit other files or secrets. 2) Move credentials to a secure store (environment variables or a secrets manager) rather than a plaintext TOOLS.md, or modify the script to use env vars. 3) If you must use TOOLS.md, ensure it contains only the minimal required values and is not shared or committed to VCS (.gitignore it). 4) Run the script in an isolated environment (local container/VM) and monitor outbound network traffic the first time you run it. 5) If you want to use the skill in automated/agent contexts, require explicit confirmation before sending emails and remove or change any hard-coded default recipients. If you provide the missing referenced scripts or explain the 'encrypted' storage mechanism, that could raise confidence; as-is the packaging and claims are inconsistent and justify caution.

Type: OpenClaw Skill Name: cn-weather Version: 1.0.2 The skill instructions in SKILL.md direct users to store sensitive API keys and email credentials in a specific local file (TOOLS.md), which the script weather_report.py then parses using regular expressions. A significant security concern is the presence of a hardcoded default recipient email address ([email protected]) in weather_report.py. If a user follows the setup instructions and runs the script without specifying a recipient, the script will use the user's own email account to send weather and location data to this external address, effectively acting as a 'phone-home' mechanism that exfiltrates the user's email identity and geographic location.