📦

cwa-weather

Name: cwa-weather
Author: tahodev

Revisión del contenido r1 Riesgo bajo ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos

Check Official Taiwan Weather Forecasts

Taiwan weather requests need reliable local forecasts with clear time periods. This skill guides CWA API queries for county and township forecasts using your authorization key.

Compatible con: Claude Codex Code(CC)

📊 74 Adecuado

Maintain this Skill? Claim it 📊 74 Adecuado

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "cwa-weather" from https://skillstore.io/skills/tahodev-cwa-weather.md and its manifest at https://skillstore.io/api/skills/tahodev-cwa-weather/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/tahodev-cwa-weather.md Manifest firmado GET /api/skills/tahodev-cwa-weather/manifest Lockfile firmado GET /api/skills/tahodev-cwa-weather/lockfile

Pruébalo

Usando "cwa-weather". Show an example of a Taipei forecast summary.

Resultado esperado:

Historical example from the skill, not a current forecast: Taipei City, September 14, 2026, daytime. Cloudy with brief showers; rain probability 30%; temperatures 25-30 C.

Usando "cwa-weather". Check Taipei weather without a CWA key.

Resultado esperado:

A valid CWA authorization key is required. Obtain one from the CWA open-data platform, or use the separate taiwan-weather skill if available.

Usando "cwa-weather". The township API returns every Taipei district despite my location filter.

Resultado esperado:

The skill documents this behavior for township datasets. Retrieve the city response and select Daan District locally before summarizing its forecast periods.

Auditoría de seguridad

Riesgo bajo

v1 • 13/10/2026 Abrir el informe versionado

Most alerts are false positives from Markdown backticks, official CWA links, dataset descriptions, and readable multilingual text. Predictable temporary files create overwrite and forecast-tampering risks, while command-line authorization URLs can expose API keys. No evidence found of prompt injection, malicious exfiltration, or concealed executable content.

Archivos escaneados

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Bajo

SKILL.md:29 SKILL.md:40

API Key Exposure Through Command-Line URLs

Both curl examples place the authorization key in a URL argument. Substituting a real key can expose it through process listings or command logs.

Both examples visibly put Authorization in the command-line URL. The secrecy guidance excludes replies and commits but does not prevent process-argument exposure.

Elementos de revisión de capacidades (3)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

SKILL.md:29

Temp directory access

curl -sm 30 'https://opendata.cwa.gov.tw/api/v1/rest/datastore/F-C0032-001?Authorization=<授權碼>&locat

curl writes to the predictable shared path /tmp/cwa.json without exclusive creation. A local attacker could pre-create a symlink and redirect the write.

Medio

SKILL.md:40

Temp directory access

curl -sm 30 'https://opendata.cwa.gov.tw/api/v1/rest/datastore/F-D0047-061?Authorization=<授權碼>' -o /

curl writes to the predictable shared path /tmp/cwa_tpe.json without exclusive creation. A pre-existing symlink could cause an unintended file overwrite.

Medio

SKILL.md:41

Temp directory access

jq -r '.records.Locations[0].Location[] | select(.LocationName=="大安區") | .LocationName' /tmp/cwa_tpe

jq trusts /tmp/cwa_tpe.json without ownership or freshness checks. A local attacker controlling that predictable file could substitute misleading forecast data.

Factores de riesgo

⚙️ Comandos externos (16)

SKILL.md:14 SKILL.md:16 SKILL.md:24 SKILL.md:28-30 SKILL.md:30-32 SKILL.md:32-33 SKILL.md:33 SKILL.md:37 SKILL.md:39-42 SKILL.md:42-46 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:52-53 SKILL.md:53 SKILL.md:54-56

🌐 Acceso a red (8)

SKILL.md:16 SKILL.md:18 SKILL.md:29 SKILL.md:37 SKILL.md:40 SKILL.md:53 SKILL.md:65 SKILL.md:75

📁 Acceso al sistema de archivos (3)

SKILL.md:29 SKILL.md:40 SKILL.md:41

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/tahodev-cwa-weather/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/tahodev-cwa-weather/security.svg)](https://skillstore.io/skills/tahodev-cwa-weather?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/tahodev-cwa-weather?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tahodev-cwa-weather/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/tahodev-cwa-weather.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

tahodev. (2026). cwa-weather security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/tahodev-cwa-weather/audits/1

Cita BibTeX

@techreport{tahodev-tahodev-cwa-weather-2026,
  author = {tahodev},
  title = {cwa-weather security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/tahodev-cwa-weather/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cwa-weather security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "tahodev"
date-released: "2026-10-13"
url: "https://skillstore.io/skills/tahodev-cwa-weather/audits/1"
identifiers:
  - type: other
    value: "skillstore:tahodev-cwa-weather:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Plan a Local Trip

Review temperature ranges and rain probabilities for the next 36 hours before visiting a Taiwan county.

Compare Work Locations

Compare forecast periods across multiple counties to support outdoor work scheduling.

Prepare a District Weather Brief

Retrieve a township dataset, select the requested district, and summarize conditions with explicit forecast times.

Prueba estos prompts

Check One County

Check Taipei City weather for the next 36 hours using my configured CWA key. Include forecast periods, temperatures, and rain probabilities.

Compare Two Counties

Compare Taipei City and New Taipei City forecasts for tomorrow. Match forecast periods and include rain probability, temperature ranges, and comfort indicators.

Select a Township Forecast

Retrieve Taipei township forecasts and filter locally for Daan District. Summarize available periods and weather fields without exposing my configured authorization key.

Handle Forecast Failures

Query county and township forecasts for Taipei using private temporary files. Validate responses, limit retries, and report failures without substituting historical data.

Mejores prácticas

Keep authorization keys outside replies, commits, process arguments, and logs.
Use private temporary storage or direct parsing, and validate each API response before summarizing.
Include forecast periods, verify dataset identifiers, and distinguish official forecasts from alternate sources.

Evitar

Presenting historical examples or failed responses as current weather.
Assuming township locationName parameters reliably filter every district.
Using this forecast skill as a substitute for authoritative emergency warnings.

Preguntas frecuentes

Do I need an API key?

Yes. Obtain a CWA authorization key from its open-data platform. Missing or invalid keys produce authorization errors.

Which forecast areas are supported?

The instructions cover county forecasts and township datasets. Taipei township access is documented; other county dataset IDs require catalog verification.

What weather details can I request?

County forecasts include weather conditions, rain probability, minimum and maximum temperatures, comfort indicators, and forecast periods.

Can this skill retrieve emergency warnings?

Emergency warnings are outside its main scope. It refers to the separate taiwan-weather skill and official CWA announcements.

Why do township results include other districts?

The documented township request returns all districts despite locationName. Select the requested district locally after downloading the dataset.

What happens when the API fails?

Use a 30-second timeout and one or two retries for connection or server failures. Report unresolved errors without inventing forecasts.

Detalles del desarrollador

Autor

tahodev

Licencia

MIT

Revisión de Skillstore

Aviso de versión

El autor no declaró una versión.

Repositorio

https://github.com/tahodev/baodao-skill/tree/3ce4b58e4525f5a66390e1236b6d38702790225a/cwa-weather

Ref.

2aab20a3878daa05021884e089a7dd7739e08581

Actualidad del mantenimiento

13/10/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📄 SKILL.md