mcp-aviation-weather

Aviation weather data — METAR observations, TAF forecasts, and nearby station discovery via L402 API. Use for flight planning, airport weather checks, and av...

This skill seems to do what it says (fetch METAR/TAF/nearby stations) and doesn't ask for secrets, but there are packaging/instruction mismatches you should clear up before installing: - Env var mismatch: SKILL.md/registry declare L402_API_BASE_URL but the code reads NAUTDEV_BASE_URL (defaulting to https://api.nautdev.com). If you set only L402_API_BASE_URL the running code will ignore it. Either set NAUTDEV_BASE_URL in your environment or ask the author to fix the docs/manifest to use one consistent variable. - Package identity mismatch: README and package.json reference different scoped names/authors. Confirm the npm package name (@vbotholemu/mcp-aviation-weather) and publisher are legitimate before running npx to fetch it. - Network behavior: The tool will contact api.nautdev.com by default. If you need to avoid that, set the correct BASE env var to your preferred endpoint or don't provide the env var to force a failure instead of using the default. - Runtime download: Running via npx will fetch and execute code from npm — only do this for packages you trust. Consider reviewing the package contents on the registry (or installing in an isolated environment) before allowing the agent to run it. If you want to proceed safely: ask the publisher to fix the env-var and README inconsistencies, verify the package on npm/github, or run the package locally in a sandbox and set NAUTDEV_BASE_URL explicitly to the endpoint you expect. If the author cannot explain the mismatches, treat this as a red flag and avoid installing.

Type: OpenClaw Skill Name: mcp-aviation-weather Version: 1.0.0 The skill is a standard Model Context Protocol (MCP) server designed to fetch aviation weather data (METAR, TAF, and station info) from the nautdev.com API. The implementation in src/index.ts and dist/index.js uses standard SDKs and includes proper input validation via Zod and URL encoding. While there are minor documentation inconsistencies in SKILL.md and README.md regarding environment variable names (L402_API_BASE_URL vs NAUTDEV_BASE_URL) and tool naming conventions, these are functional bugs rather than security threats. No evidence of data exfiltration, malicious execution, or prompt injection was found.