← 返回 Skills 市场
147
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install weather-ultra
功能描述
天气查询，含空气质量、日出日落、Golden/Blue Hour、朝霞晚霞预测。触发词：天气、天气预报、几点日落、霞光、朝霞、晚霞、golden hour、blue hour。适合摄影师和户外活动规划。
安全使用建议
What to consider before installing:
- The included script needs two API keys (WEATHERAPI_KEY and SUNSETHUE_KEY) but the skill metadata did not declare them — confirm you are asked to provide only those keys and that you trust the endpoints (weatherapi.com and api.sunsethue.com).
- The script sources ~/.openclaw/.env (runs it as shell code). That means any commands in that file will be executed. Inspect the file before use and avoid placing unrelated secrets or commands there. Prefer providing just the two API keys in a safe, minimal file or environment rather than leaving a file with arbitrary content in ~/.openclaw/.env.
- The script embeds API keys in GET query strings; this can expose keys in logs or network traces. If you must use keys, consider using a dedicated key with limited scope or ask the maintainer to use POST or Authorization headers.
- The script assumes curl and jq are installed but the skill did not declare these dependencies; install them or request the author to declare requirements.
If you are not comfortable: do not install or run the script until the author updates the skill metadata to declare required env vars, removes unsafe 'source' behavior (or documents it clearly), and documents dependencies. If you proceed, review ~/.openclaw/.env contents and limit the provided API keys to only what is needed.
功能分析
Type: OpenClaw Skill
Name: weather-ultra
Version: 1.0.0
The skill provides weather and photography-related lighting data by querying external APIs (api.weatherapi.com and api.sunsethue.com). It is classified as suspicious because the script `scripts/weather-full.sh` lacks input sanitization for the `CITY` and `DAYS` arguments, which are used directly within a `curl` command. This creates a shell injection vulnerability where a crafted input (e.g., using backticks or command substitution) could lead to arbitrary code execution. No evidence of intentional malice or data exfiltration was found.
能力评估
Purpose & Capability
The script performs weather and sunrise/sunset/quality queries (WeatherAPI and sunsethue) which match the skill's description. However the skill metadata declared no required environment variables or credentials while the script expects WEATHERAPI_KEY and SUNSETHUE_KEY — an incoherence between claimed requirements and actual needs.
Instruction Scope
The runtime script sources ~/.openclaw/.env if present (using shell source), which executes any code in that file rather than just reading key/value pairs. That grants the skill the ability to run arbitrary commands from a user file without explicit declaration. Otherwise the script's network calls go only to weatherapi.com and api.sunsethue.com which are consistent with purpose.
Install Mechanism
This is instruction-only with a bundled shell script (no installer). The script assumes presence of curl and jq but the registry lists no required binaries; missing these will cause runtime errors. No downloads or external install URLs are used.
Credentials
The script relies on two API keys (WEATHERAPI_KEY and SUNSETHUE_KEY) which are proportional to the functionality, but they are not declared in the skill metadata. More importantly, sourcing ~/.openclaw/.env may expose unrelated secrets or execute arbitrary content — a disproportionate access pattern relative to the stated purpose.
Persistence & Privilege
The skill does not request persistent/autonomous elevation (always:false) and does not modify system or other skills' config. It runs as an on-demand script, so persistence/privilege level is appropriate.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install weather-ultra - 安装完成后，直接呼叫该 Skill 的名称或使用
/weather-ultra触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release: 天气查询 + 朝霞晚霞预测 + Golden/Blue Hour
元数据
常见问题
Weather Ultra 是什么？
天气查询，含空气质量、日出日落、Golden/Blue Hour、朝霞晚霞预测。触发词：天气、天气预报、几点日落、霞光、朝霞、晚霞、golden hour、blue hour。适合摄影师和户外活动规划。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 147 次。
如何安装 Weather Ultra？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install weather-ultra」即可一键安装，无需额外配置。
Weather Ultra 是免费的吗？
是的，Weather Ultra 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Weather Ultra 支持哪些平台？
Weather Ultra 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Weather Ultra？
由 Pazzilivo（@pazzilivo）开发并维护，当前版本 v1.0.0。
推荐 Skills