get tomorrow weather of beijing , with Chinese almanac information

获取北京明日天气预报和黄历，每天下午6点推送。包含气温对比提醒（波动超5℃警告）、雨天带伞提醒、以及第二天的黄历信息。

技能总体内部一致且用途明确，但在安装/使用前请确认： - 如果你打算让技能使用 mxnzp 黄历 API，你需要提供 app_id/app_secret；当前元数据没有声明这些凭据，因此需要在配置或调用时明确传入。否则技能会退回到网页搜索抓取黄历。 - 确认消息推送所用的 message 工具（飞书）如何接收目标 openid/目标用户：确保你信任该工具并理解谁会收到消息。 - 技能会调用外部服务（wttr.in 与搜索结果）；如果你对隐私或数据外发敏感，评估这些请求是否接受。 - 技能提到由 cron 在 18:00 触发，但没有安装/注册定时任务的具体步骤；确认你的运行环境如何安排定时执行（或手动触发）。 总体而言可以安装，但在把凭据或收件人信息交给技能前先确认运行细节与信任边界。

Type: OpenClaw Skill Name: weather-of-beijing-with-almanac Version: 1.0.2 The skill is classified as suspicious due to the insecure handling of API credentials. In SKILL.md, Step 2 instructs the agent to make a `curl` request to `https://www.mxnzp.com/api/holiday/single/...` including `app_id=your_app_id&app_secret=your_secret` directly in the URL query parameters. This method of transmitting sensitive `app_secret` via a GET request is insecure, as it can expose the secret in server logs, browser history, or network intermediaries. While the intent appears to be to use legitimate credentials for the skill's stated purpose, the instruction itself represents a significant vulnerability for credential exposure, relying on the agent's interpretation and secure handling of such placeholders.