和风天气查询功能

天气查询：使用和风天气（JWT+Host）获取实时天气与未来预报；支持城市名/LocationID/经纬度；缺省地点可用 QWEATHER_DEFAULT_LOCATION。

This skill mostly does what it says (weather lookups), but it expects enterprise-style JWT credentials and a private key while the registry metadata declares no required secrets. Before installing, ask the author to: 1) explicitly list required env vars and the primary credential in the registry (PROJECT_ID, CREDENTIALS_ID, QWEATHER_PRIVATE_KEY_PATH or QWEATHER_API_HOST); 2) remove any checked-in private key files (or confirm the file is only a harmless placeholder) and instead require the private key path be provided via a secure env var or secret store; 3) confirm the API_HOST and other config are not hard-coded placeholders; and 4) document why QWEATHER_FREE_API_KEY and QWEATHER_DEFAULT_LOCATION are needed. If you cannot verify those, avoid installing or running the skill with real credentials on sensitive systems.

Type: OpenClaw Skill Name: qweather Version: 1.0.0 The skill is designed to query weather data using the QWeather API, which requires JWT authentication. This involves reading a private key from a file (`lib/ed25519-private.txt` is a template, but the code in `lib/qweather_jwt_session.js` and `lib/gen_qweather_token.js` uses `fs.readFileSync` to load it). While this file access is necessary for the skill's stated purpose of JWT signing, it represents a high-risk capability (direct access to a private key file) that could be exploited if the `PRIVATE_KEY_PATH` configuration were maliciously altered. Additionally, the `gen_qweather_token.js` utility script logs the generated JWT token to the console, which could be a minor information leak in certain environments.