KMA short-term forecast API - ultra-short-term observation/forecast, short-term forecast

This skill appears to implement exactly what it claims (KMA forecasts + AirKorea), but I recommend caution because of several inconsistencies before you install or enable it: - API key handling: SKILL.md says to store your data.go.kr key at ~/.config/data-go-kr/api_key, and weather.sh reads that path, but morning_briefing.py opens /home/scott/.config/data-go-kr/api_key (hardcoded). That is likely a developer leftover — either fix the script to use the documented path or ensure the file exists where the script expects it. Do not store keys in world-readable locations; set file permissions to restrict access (chmod 600). - Undeclared runtime dependencies: The scripts call curl, jq and python3. The registry lists no required binaries. Make sure your runtime has curl, jq, and python3 available, or modify the scripts to handle missing tools. - Undocumented credential requirement: The registry metadata lists no required env vars/credentials but the scripts require an API key file. Treat the API key as sensitive and confirm it's only used to call the listed government APIs. You can prefer using an environment variable or secure secret store instead of a file to avoid accidental exposure. - Hardcoded user path: The /home/scott path is suspicious (likely a leftover). Inspect and edit morning_briefing.sh/python to read the same path as weather.sh (~/.config/data-go-kr/api_key) or to accept the key via argument/ENV. Running the skill as-is could fail or unintentionally read another user's key if that path exists. - Cross-skill assumptions: The SKILL.md expects an AirKorea skill and a notify connector. If you don't have those, the integrated features will fail. Review scripts and test them locally in a safe environment before enabling agent-autonomous invocation. If you want to proceed: review and patch morning_briefing to remove the hardcoded /home/scott path, ensure proper file permissions, declare the required binaries/credentials in metadata, and consider switching to an environment variable or explicit configuration parameter for the API key. If you want, I can produce a patched morning_briefing.sh/python snippet that uses ~/.config/data-go-kr/api_key or accepts an environment variable.

Type: OpenClaw Skill Name: kma-weather-korea Version: 2.2.0 The skill bundle is benign. It accesses an API key from `~/.config/data-go-kr/api_key` (or a hardcoded `/home/scott/...` path in one script, which is a minor bug, not malicious) and makes network requests to legitimate Korean government weather and air quality APIs (`apis.data.go.kr`). All actions, including instructions in `SKILL.md` and `playbook.md`, are aligned with its stated purpose of providing weather forecasts and air quality information. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, prompt injection attempts, or obfuscation.