📦

cwa-weather

Name: cwa-weather
Author: tahodev

Révision du contenu r1 Risque faible ⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers

Check Official Taiwan Weather Forecasts

Taiwan weather requests need reliable local forecasts with clear time periods. This skill guides CWA API queries for county and township forecasts using your authorization key.

Prend en charge: Claude Codex Code(CC)

📊 74 Adéquat

Maintain this Skill? Claim it 📊 74 Adéquat

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "cwa-weather" from https://skillstore.io/skills/tahodev-cwa-weather.md and its manifest at https://skillstore.io/api/skills/tahodev-cwa-weather/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/tahodev-cwa-weather.md manifest signé GET /api/skills/tahodev-cwa-weather/manifest lockfile signé GET /api/skills/tahodev-cwa-weather/lockfile

Tester

Utilisation de « cwa-weather ». Show an example of a Taipei forecast summary.

Résultat attendu:

Historical example from the skill, not a current forecast: Taipei City, September 14, 2026, daytime. Cloudy with brief showers; rain probability 30%; temperatures 25-30 C.

Utilisation de « cwa-weather ». Check Taipei weather without a CWA key.

Résultat attendu:

A valid CWA authorization key is required. Obtain one from the CWA open-data platform, or use the separate taiwan-weather skill if available.

Utilisation de « cwa-weather ». The township API returns every Taipei district despite my location filter.

Résultat attendu:

The skill documents this behavior for township datasets. Retrieve the city response and select Daan District locally before summarizing its forecast periods.

Audit de sécurité

Risque faible

v1 • 13/10/2026 Ouvrir le rapport versionné

Most alerts are false positives from Markdown backticks, official CWA links, dataset descriptions, and readable multilingual text. Predictable temporary files create overwrite and forecast-tampering risks, while command-line authorization URLs can expose API keys. No evidence found of prompt injection, malicious exfiltration, or concealed executable content.

Fichiers analysés

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (1)

Faible

SKILL.md:29 SKILL.md:40

API Key Exposure Through Command-Line URLs

Both curl examples place the authorization key in a URL argument. Substituting a real key can expose it through process listings or command logs.

Both examples visibly put Authorization in the command-line URL. The secrecy guidance excludes replies and commits but does not prevent process-argument exposure.

Éléments d’évaluation des capacités (3)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Moyen

SKILL.md:29

Temp directory access

curl -sm 30 'https://opendata.cwa.gov.tw/api/v1/rest/datastore/F-C0032-001?Authorization=<授權碼>&locat

curl writes to the predictable shared path /tmp/cwa.json without exclusive creation. A local attacker could pre-create a symlink and redirect the write.

Moyen

SKILL.md:40

Temp directory access

curl -sm 30 'https://opendata.cwa.gov.tw/api/v1/rest/datastore/F-D0047-061?Authorization=<授權碼>' -o /

curl writes to the predictable shared path /tmp/cwa_tpe.json without exclusive creation. A pre-existing symlink could cause an unintended file overwrite.

Moyen

SKILL.md:41

Temp directory access

jq -r '.records.Locations[0].Location[] | select(.LocationName=="大安區") | .LocationName' /tmp/cwa_tpe

jq trusts /tmp/cwa_tpe.json without ownership or freshness checks. A local attacker controlling that predictable file could substitute misleading forecast data.

Facteurs de risque

⚙️ Commandes externes (16)

SKILL.md:14 SKILL.md:16 SKILL.md:24 SKILL.md:28-30 SKILL.md:30-32 SKILL.md:32-33 SKILL.md:33 SKILL.md:37 SKILL.md:39-42 SKILL.md:42-46 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:52-53 SKILL.md:53 SKILL.md:54-56

🌐 Accès réseau (8)

SKILL.md:16 SKILL.md:18 SKILL.md:29 SKILL.md:37 SKILL.md:40 SKILL.md:53 SKILL.md:65 SKILL.md:75

📁 Accès au système de fichiers (3)

SKILL.md:29 SKILL.md:40 SKILL.md:41

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/tahodev-cwa-weather/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/tahodev-cwa-weather/security.svg)](https://skillstore.io/skills/tahodev-cwa-weather?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/tahodev-cwa-weather?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tahodev-cwa-weather/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/tahodev-cwa-weather.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

tahodev. (2026). cwa-weather security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/tahodev-cwa-weather/audits/1

Citation BibTeX

@techreport{tahodev-tahodev-cwa-weather-2026,
  author = {tahodev},
  title = {cwa-weather security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/tahodev-cwa-weather/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cwa-weather security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "tahodev"
date-released: "2026-10-13"
url: "https://skillstore.io/skills/tahodev-cwa-weather/audits/1"
identifiers:
  - type: other
    value: "skillstore:tahodev-cwa-weather:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Plan a Local Trip

Review temperature ranges and rain probabilities for the next 36 hours before visiting a Taiwan county.

Compare Work Locations

Compare forecast periods across multiple counties to support outdoor work scheduling.

Prepare a District Weather Brief

Retrieve a township dataset, select the requested district, and summarize conditions with explicit forecast times.

Essayez ces prompts

Check One County

Check Taipei City weather for the next 36 hours using my configured CWA key. Include forecast periods, temperatures, and rain probabilities.

Compare Two Counties

Compare Taipei City and New Taipei City forecasts for tomorrow. Match forecast periods and include rain probability, temperature ranges, and comfort indicators.

Select a Township Forecast

Retrieve Taipei township forecasts and filter locally for Daan District. Summarize available periods and weather fields without exposing my configured authorization key.

Handle Forecast Failures

Query county and township forecasts for Taipei using private temporary files. Validate responses, limit retries, and report failures without substituting historical data.

Bonnes pratiques

Keep authorization keys outside replies, commits, process arguments, and logs.
Use private temporary storage or direct parsing, and validate each API response before summarizing.
Include forecast periods, verify dataset identifiers, and distinguish official forecasts from alternate sources.

Éviter

Presenting historical examples or failed responses as current weather.
Assuming township locationName parameters reliably filter every district.
Using this forecast skill as a substitute for authoritative emergency warnings.

Foire aux questions

Do I need an API key?

Yes. Obtain a CWA authorization key from its open-data platform. Missing or invalid keys produce authorization errors.

Which forecast areas are supported?

The instructions cover county forecasts and township datasets. Taipei township access is documented; other county dataset IDs require catalog verification.

What weather details can I request?

County forecasts include weather conditions, rain probability, minimum and maximum temperatures, comfort indicators, and forecast periods.

Can this skill retrieve emergency warnings?

Emergency warnings are outside its main scope. It refers to the separate taiwan-weather skill and official CWA announcements.

Why do township results include other districts?

The documented township request returns all districts despite locationName. Select the requested district locally after downloading the dataset.

What happens when the API fails?

Use a 30-second timeout and one or two retries for connection or server failures. Report unresolved errors without inventing forecasts.

Détails du développeur

Auteur

tahodev

Licence

MIT

Révision Skillstore

Avis de version

L’auteur n’a déclaré aucune version.

Dépôt

https://github.com/tahodev/baodao-skill/tree/3ce4b58e4525f5a66390e1236b6d38702790225a/cwa-weather

Réf

2aab20a3878daa05021884e089a7dd7739e08581

Récence de maintenance

13/10/2026

Utilisation

0 téléchargements · 0 vues

Structure de fichiers

📄 SKILL.md