← 返回 Skills 市场
137
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install qweather-self-growing
功能描述
Global weather queries powered by QWeather. Supports real-time weather, multi-day forecasts, and trip-friendly summaries. Self-growing — expands along offici...
安全使用建议
Before installing: 1) Note the registry metadata does NOT list the required secrets — the skill actually needs QWEATHER_KID, QWEATHER_PROJECT_ID, QWEATHER_PRIVATE_KEY_PATH, and QWEATHER_API_HOST (or a local/qweather.json). Ask the author to update the metadata. 2) The skill asks the agent to generate and store an Ed25519 private key and may default to ~/.ssh — do NOT accept default locations without verifying (use a dedicated secure path and do not overwrite existing SSH keys). 3) Inspect scripts yourself (they are present) and run init/test manually instead of letting an agent run them automatically; verify local/ is excluded from backups/version control so private data isn't leaked. 4) Understand the agent is instructed to 'self-grow' and update SKILL.md/files when adding features — clarify whether such changes require your explicit approval (prefer manual commits/PRs). 5) If you proceed, keep the private key and local/ directory offline/safely stored, and only provide the minimal credentials required. If the author cannot correct the missing metadata or clarify the self-modification behavior, treat installation as higher risk.
功能分析
Type: OpenClaw Skill
Name: qweather-self-growing
Version: 1.0.0
The skill bundle is a well-structured weather query tool for the QWeather API. It features a 'self-growing' design that encourages the AI agent to expand capabilities based on official documentation. Key components include JWT authentication (gen-jwt.mjs), multi-layered city resolution (qweather.sh), and an automated initialization script (init.sh) that fetches legitimate city data from GitHub. While the instructions guide the agent to manage sensitive Ed25519 keys and modify its own SKILL.md, these actions are strictly aligned with the stated purpose of API setup and capability expansion, with no evidence of malicious intent, data exfiltration, or unauthorized access.
能力标签
能力评估
Purpose & Capability
The skill's description is a weather client for QWeather, which legitimately requires KID, Project ID, API Host, and a private key for JWT-based auth. However the registry metadata declares no required environment variables or primary credential even though the code and SKILL.md clearly require secrets (QWEATHER_KID, QWEATHER_PROJECT_ID, QWEATHER_PRIVATE_KEY_PATH, QWEATHER_API_HOST or local/qweather.json). This mismatch between declared requirements and actual needed credentials is incoherent and should be fixed or explained by the author.
Instruction Scope
SKILL.md instructs the agent to perform an interactive first-use flow: collect the three secret values from the user, generate an Ed25519 keypair (defaulting to ~/.ssh/ if user unsure), prompt the user to upload the public key, create local/qweather.json, and automatically run bash scripts (init.sh and test.sh). Those instructions give the agent broad permission to write files, execute local scripts, and (per the 'self-growing' language) to update SKILL.md and capabilities. While this is plausible for setup, it grants the agent discretionary file-system and code-modification actions that are not enforced by the code and therefore raise scope and safety concerns.
Install Mechanism
There is no package install spec; the skill is instruction + scripts. The only remote download is LocationList CSV from a known GitHub raw URL. No arbitrary installers or external archives are fetched. Risk from install mechanism itself is low.
Credentials
The runtime code reads a private key file and requires KID, Project ID, and API Host to construct signed JWTs — these are appropriate for QWeather integration. But the skill metadata failed to declare these required env vars/primary credential. The gen-jwt.mjs will load a private key path and sign tokens and also cache tokens to local/jwt-cache.json; storing private auth material under local/ without clear protections can be risky if local/ is synced or backed up. Requiring a user's private key and advising a default save location of ~/.ssh increases the potential for accidental exposure or key management mistakes.
Persistence & Privilege
The skill does not request always:true and does not modify other skills. However SKILL.md's 'self-growing' guidance and the first-use flow instruct the agent to write local configuration (local/qweather.json, jwt-cache.json) and possibly generate a private key in a default system directory (~/.ssh) — actions that create persistent artifacts on the host. This is not inherently malicious but users should control where keys/config are stored and whether the agent is allowed to run commands that create files.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install qweather-self-growing - 安装完成后，直接呼叫该 Skill 的名称或使用
/qweather-self-growing触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release: JWT (Ed25519) auth with token caching, 3-tier offline-first city lookup (3500+ CN cities), real-time/3d/7d forecasts, trip-friendly summaries, and self-growing architecture along QWeather official API docs.
元数据
常见问题
QWeather 是什么？
Global weather queries powered by QWeather. Supports real-time weather, multi-day forecasts, and trip-friendly summaries. Self-growing — expands along offici... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 137 次。
如何安装 QWeather？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install qweather-self-growing」即可一键安装，无需额外配置。
QWeather 是免费的吗？
是的，QWeather 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
QWeather 支持哪些平台？
QWeather 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 QWeather？
由 GNIXNER（@gnixner）开发并维护，当前版本 v1.0.0。
推荐 Skills