📦

cwa-weather

Name: cwa-weather
Author: tahodev

Ревизия содержимого r1 Низкий риск ⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе

Check Official Taiwan Weather Forecasts

Taiwan weather requests need reliable local forecasts with clear time periods. This skill guides CWA API queries for county and township forecasts using your authorization key.

Поддерживает: Claude Codex Code(CC)

📊 74 Адекватно

Maintain this Skill? Claim it 📊 74 Адекватно

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "cwa-weather" from https://skillstore.io/skills/tahodev-cwa-weather.md and its manifest at https://skillstore.io/api/skills/tahodev-cwa-weather/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/tahodev-cwa-weather.md Подписанный manifest GET /api/skills/tahodev-cwa-weather/manifest Подписанный lockfile GET /api/skills/tahodev-cwa-weather/lockfile

Протестировать

Использование «cwa-weather». Show an example of a Taipei forecast summary.

Ожидаемый результат:

Historical example from the skill, not a current forecast: Taipei City, September 14, 2026, daytime. Cloudy with brief showers; rain probability 30%; temperatures 25-30 C.

Использование «cwa-weather». Check Taipei weather without a CWA key.

Ожидаемый результат:

A valid CWA authorization key is required. Obtain one from the CWA open-data platform, or use the separate taiwan-weather skill if available.

Использование «cwa-weather». The township API returns every Taipei district despite my location filter.

Ожидаемый результат:

The skill documents this behavior for township datasets. Retrieve the city response and select Daan District locally before summarizing its forecast periods.

Аудит безопасности

Низкий риск

v1 • 13.10.2026 Открыть версионный отчет

Most alerts are false positives from Markdown backticks, official CWA links, dataset descriptions, and readable multilingual text. Predictable temporary files create overwrite and forecast-tampering risks, while command-line authorization URLs can expose API keys. No evidence found of prompt injection, malicious exfiltration, or concealed executable content.

Просканировано файлов

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (1)

Низкий

SKILL.md:29 SKILL.md:40

API Key Exposure Through Command-Line URLs

Both curl examples place the authorization key in a URL argument. Substituting a real key can expose it through process listings or command logs.

Both examples visibly put Authorization in the command-line URL. The secrecy guidance excludes replies and commits but does not prevent process-argument exposure.

Пункты проверки возможностей (3)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Средний

SKILL.md:29

Temp directory access

curl -sm 30 'https://opendata.cwa.gov.tw/api/v1/rest/datastore/F-C0032-001?Authorization=<授權碼>&locat

curl writes to the predictable shared path /tmp/cwa.json without exclusive creation. A local attacker could pre-create a symlink and redirect the write.

Средний

SKILL.md:40

Temp directory access

curl -sm 30 'https://opendata.cwa.gov.tw/api/v1/rest/datastore/F-D0047-061?Authorization=<授權碼>' -o /

curl writes to the predictable shared path /tmp/cwa_tpe.json without exclusive creation. A pre-existing symlink could cause an unintended file overwrite.

Средний

SKILL.md:41

Temp directory access

jq -r '.records.Locations[0].Location[] | select(.LocationName=="大安區") | .LocationName' /tmp/cwa_tpe

jq trusts /tmp/cwa_tpe.json without ownership or freshness checks. A local attacker controlling that predictable file could substitute misleading forecast data.

Факторы риска

⚙️ Внешние команды (16)

SKILL.md:14 SKILL.md:16 SKILL.md:24 SKILL.md:28-30 SKILL.md:30-32 SKILL.md:32-33 SKILL.md:33 SKILL.md:37 SKILL.md:39-42 SKILL.md:42-46 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:52-53 SKILL.md:53 SKILL.md:54-56

🌐 Доступ к сети (8)

SKILL.md:16 SKILL.md:18 SKILL.md:29 SKILL.md:37 SKILL.md:40 SKILL.md:53 SKILL.md:65 SKILL.md:75

📁 Доступ к файловой системе (3)

SKILL.md:29 SKILL.md:40 SKILL.md:41

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/tahodev-cwa-weather/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/tahodev-cwa-weather/security.svg)](https://skillstore.io/skills/tahodev-cwa-weather?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/tahodev-cwa-weather?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tahodev-cwa-weather/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/tahodev-cwa-weather.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

tahodev. (2026). cwa-weather security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/tahodev-cwa-weather/audits/1

Цитата BibTeX

@techreport{tahodev-tahodev-cwa-weather-2026,
  author = {tahodev},
  title = {cwa-weather security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/tahodev-cwa-weather/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cwa-weather security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "tahodev"
date-released: "2026-10-13"
url: "https://skillstore.io/skills/tahodev-cwa-weather/audits/1"
identifiers:
  - type: other
    value: "skillstore:tahodev-cwa-weather:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Plan a Local Trip

Review temperature ranges and rain probabilities for the next 36 hours before visiting a Taiwan county.

Compare Work Locations

Compare forecast periods across multiple counties to support outdoor work scheduling.

Prepare a District Weather Brief

Retrieve a township dataset, select the requested district, and summarize conditions with explicit forecast times.

Попробуйте эти промпты

Check One County

Check Taipei City weather for the next 36 hours using my configured CWA key. Include forecast periods, temperatures, and rain probabilities.

Compare Two Counties

Compare Taipei City and New Taipei City forecasts for tomorrow. Match forecast periods and include rain probability, temperature ranges, and comfort indicators.

Select a Township Forecast

Retrieve Taipei township forecasts and filter locally for Daan District. Summarize available periods and weather fields without exposing my configured authorization key.

Handle Forecast Failures

Query county and township forecasts for Taipei using private temporary files. Validate responses, limit retries, and report failures without substituting historical data.

Лучшие практики

Keep authorization keys outside replies, commits, process arguments, and logs.
Use private temporary storage or direct parsing, and validate each API response before summarizing.
Include forecast periods, verify dataset identifiers, and distinguish official forecasts from alternate sources.

Избегать

Presenting historical examples or failed responses as current weather.
Assuming township locationName parameters reliably filter every district.
Using this forecast skill as a substitute for authoritative emergency warnings.

Часто задаваемые вопросы

Do I need an API key?

Yes. Obtain a CWA authorization key from its open-data platform. Missing or invalid keys produce authorization errors.

Which forecast areas are supported?

The instructions cover county forecasts and township datasets. Taipei township access is documented; other county dataset IDs require catalog verification.

What weather details can I request?

County forecasts include weather conditions, rain probability, minimum and maximum temperatures, comfort indicators, and forecast periods.

Can this skill retrieve emergency warnings?

Emergency warnings are outside its main scope. It refers to the separate taiwan-weather skill and official CWA announcements.

Why do township results include other districts?

The documented township request returns all districts despite locationName. Select the requested district locally after downloading the dataset.

What happens when the API fails?

Use a 30-second timeout and one or two retries for connection or server failures. Report unresolved errors without inventing forecasts.

Сведения для разработчиков

Автор

tahodev

Лицензия

MIT

Ревизия Skillstore

Примечание о версии

Автор не указал версию.

Репозиторий

https://github.com/tahodev/baodao-skill/tree/3ce4b58e4525f5a66390e1236b6d38702790225a/cwa-weather

Ссылка

2aab20a3878daa05021884e089a7dd7739e08581

Актуальность поддержки

13.10.2026

Использование

0 загрузок · 0 просмотров

Структура файлов

📄 SKILL.md