QWeather China

基于中国气象局数据的完整天气服务，通过和风天气API提供实时天气、天气预报、生活指数、空气质量等全方位天气信息。专为中国用户优化，数据更准确，功能更全面。

This package largely looks like a legitimate QWeather client, but there are a few red flags to check before installing or providing credentials: - Resolve metadata mismatch: the registry summary showed no required env vars while SKILL.md requires QWEATHER_API_HOST, QWEATHER_PROJECT_ID, QWEATHER_CREDENTIALS_ID and QWEATHER_PRIVATE_KEY_PATH. Confirm which is authoritative. - Inspect install.sh / install.bat before running. Look for network downloads, pip installs, or commands that change system files or permissions. - Review qweather.py and install scripts to ensure they only call qweatherapi endpoints and do not exfiltrate data to other domains. SKILL.md declares network endpoints limited to *.qweatherapi.com — confirm the code adheres to that. - Protect your private key: use a dedicated key with least privilege, store it at the indicated path (~/.config/qweather/private.pem) with 600 permissions, and do not reuse OpenClaw/agent keys. - If you want higher assurance, ask the publisher for a public git repository/commit history and a simple README showing the exact runtime env variables used; or run the code in an isolated environment/container and monitor outbound connections when exercising the skill. Given the metadata inconsistencies and presence of installer scripts (but otherwise coherent purpose), treat this as suspicious until you validate the items above.

Type: OpenClaw Skill Name: qweather-china Version: 1.2.2 The skill bundle provides a comprehensive weather service for China using the QWeather API. The code and instructions in SKILL.md and qweather.py are consistent with the stated purpose, implementing JWT authentication, city location handling, and multi-platform encoding support. The install.sh script follows standard procedures for dependency installation and environment verification, and the requested filesystem/network permissions are appropriately restricted to the application's configuration, cache, and the official API endpoints (*.qweatherapi.com).