技能 current-location-weather
📦

current-location-weather

内容修订 r1 中风险 🌐 网络访问⚙️ 外部命令

按位置查看当前天气

用户需要快速获取当前天气，而无需配置 API 密钥。此技能会运行一个 Python 辅助程序，用于检测位置或接受城市名称。

支持: Claude Codex Code(CC)
⚠️ 50 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "current-location-weather" from https://skillstore.io/skills/danielmax937-current-location-weather.md and its manifest at https://skillstore.io/api/skills/danielmax937-current-location-weather/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/danielmax937-current-location-weather.md 已签名 manifest GET /api/skills/danielmax937-current-location-weather/manifest 已签名 lockfile GET /api/skills/danielmax937-current-location-weather/lockfile

测试它

正在使用“current-location-weather”。 我这里天气怎么样？

预期结果:

助手会返回检测到的城市，以及包含温度、湿度、风况和天气状况的简短当前天气摘要。

正在使用“current-location-weather”。 查看巴黎天气，并包含适合规划散步的详细信息。

预期结果:

助手会报告当前温度、体感温度、风况、湿度，以及关于户外舒适度的实用说明。

正在使用“current-location-weather”。 西雅图现在我应该带伞吗？

预期结果:

助手会查看当前天气状况，并根据报告的天气给出简短建议。

安全审计

中风险
v9 • 2026/7/5 打开版本化报告

No prompt injection, obfuscation, or command-execution abuse was found; the code-fence and obfuscation alerts are false positives. The skill intentionally makes outbound requests to ip-api.com and wttr.in, including automatic IP geolocation over plaintext HTTP, so the remaining concerns are privacy and network-integrity risks.

2
已扫描文件
234
分析行数
6
复核项
0
已忽略误报

已确认安全问题 (1)

中
scripts/get_weather.py:21-37SKILL.md:68-75
Automatic IP Geolocation Privacy Exposure
When no location is provided, the script contacts ip-api.com to infer location from the caller IP before weather lookup. This behavior is disclosed, but it lacks an explicit consent step before sharing approximate location with a third-party service.
The code path calls ip-api.com automatically when location is absent, and the documentation states that IP-based location detection is used. The risk is privacy exposure rather than hidden malware.
能力复核项 (6)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中
scripts/get_weather.py:24
Hardcoded URL
with urllib.request.urlopen("http://ip-api.com/json/", timeout=10) as response:
The hardcoded ip-api.com endpoint uses plaintext HTTP for geolocation. That can expose the request path to network observers and allows response tampering in transit.
低
scripts/get_weather.py:24
Python HTTP libraries
with urllib.request.urlopen("http://ip-api.com/json/", timeout=10) as response:
The code performs an outbound request to ip-api.com to infer location from the caller IP. This exposes IP-derived location data to a third-party service.
低
scripts/get_weather.py:68
Python HTTP libraries
req = urllib.request.Request(url, headers={"User-Agent": "curl/7.68.0"})
The Request object prepares an outbound call to wttr.in using the requested or detected location. This is intended behavior, but it still shares location context with an external service.
低
scripts/get_weather.py:69
Python HTTP libraries
with urllib.request.urlopen(req, timeout=15) as response:
The urlopen call sends the weather request to wttr.in. The endpoint is part of the skill function, but it is real external network access.
低
scripts/get_weather.py:62
Hardcoded URL
url = f"https://wttr.in/{encoded_location}?format=j1"
The hardcoded wttr.in JSON endpoint is an intended weather provider. It is still an external dependency that receives the requested location.
低
scripts/get_weather.py:65
Hardcoded URL
url = f"https://wttr.in/{encoded_location}?format=%l:+%c+%t+%h+%w"
The hardcoded wttr.in text endpoint is an intended weather provider. It creates a real third-party network request with location context.

风险因素

🌐 网络访问 (7)
scripts/get_weather.py:17 scripts/get_weather.py:24 scripts/get_weather.py:68 scripts/get_weather.py:69 scripts/get_weather.py:24 scripts/get_weather.py:62 scripts/get_weather.py:65
⚙️ 外部命令 (12)
SKILL.md:14-16 SKILL.md:16-21 SKILL.md:21-23 SKILL.md:23-26 SKILL.md:26-29 SKILL.md:29-32 SKILL.md:32-35 SKILL.md:35-40 SKILL.md:40-43 SKILL.md:43-46 SKILL.md:46-64 SKILL.md:64-76
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/danielmax937-current-location-weather/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/danielmax937-current-location-weather/security.svg)](https://skillstore.io/skills/danielmax937-current-location-weather?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/danielmax937-current-location-weather?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/danielmax937-current-location-weather/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/danielmax937-current-location-weather.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

DanielMax937. (2026). current-location-weather security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/danielmax937-current-location-weather/audits/9

BibTeX 引用

@techreport{danielmax937-danielmax937-current-location-weather-2026, author = {DanielMax937}, title = {current-location-weather security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/danielmax937-current-location-weather/audits/9}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "current-location-weather security audit report (audit version 9)" version: "unspecified" type: report authors: - name: "DanielMax937" date-released: "2026-07-05" url: "https://skillstore.io/skills/danielmax937-current-location-weather/audits/9" identifiers: - type: other value: "skillstore:danielmax937-current-location-weather:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 高
45
架构
85
可维护性
85
内容
70
社区
91
规范符合性

你能构建什么

规划日常通勤

在决定穿着、出发时间或是否需要带伞前，查看当前天气状况。

查看旅行天气状况

出发或打包前，查询目的地城市的当前天气。

为助手任务添加天气上下文

当助手需要天气上下文来完成工作流时，使用文本或结构化输出。

试试这些提示

当前天气 
使用 current-location-weather 查看我当前位置的天气。
指定城市天气 
查看日本东京的当前天气，并总结温度、天气状况、湿度和风况。
结构化天气摘要 
获取伦敦当前天气的结构化输出，然后总结温度、体感温度、湿度、风况和紫外线指数。
比较目的地天气状况 
查看纽约、柏林和首尔的当前天气，然后为每个城市给出简洁的打包建议。

最佳实践

  • 在隐私或准确性很重要时，使用具体城市。
  • 在天气查询前说明你想要简洁文本还是结构化详情。
  • 涉及恶劣天气、旅行或安全决策时，请通过官方天气来源进行核实。

避免

  • 如果你不想联系地理定位服务，请不要使用自动检测。
  • 不要将当前天气状况视为长期预报。
  • 不要依赖此技能获取紧急天气警报或做出安全关键决策。

常见问题

此技能需要 API 密钥吗？
不需要。它使用无需 API 密钥的公共服务。
它如何找到我的当前位置？
它可以联系 ip-api.com，根据调用方 IP 地址估算位置。
我可以避免基于 IP 的位置检测吗？
可以。在请求中提供城市或地区，即可改用该位置。
它使用什么天气来源？
它从 wttr.in 请求当前天气数据。
它可以返回详细天气字段吗？
可以。结构化输出可包含温度、湿度、风况、紫外线指数、能见度、气压和云量。
它适合用于紧急天气警报吗？
不适合。请使用官方天气服务获取预警、紧急警报和安全决策信息。

开发者详情

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/DanielMax937/pocker/tree/main/current-location-weather/

引用

7e9e368dc1a370f2040369ebcd0db06d90cb48e5

维护新鲜度

2026/7/18

使用量

7 次下载 · 168 次浏览

文件结构

📁 scripts/

📄 get_weather.py

📄 SKILL.md

相关技能

查看全部