技能 cwa-weather
📦

cwa-weather

内容修订 r1 低风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问

Check Official Taiwan Weather Forecasts

Taiwan weather requests need reliable local forecasts with clear time periods. This skill guides CWA API queries for county and township forecasts using your authorization key.

支持: Claude Codex Code(CC)
📊 74 合格

使用我的智能体安装

将此请求复制给你的智能体,其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "cwa-weather" from https://skillstore.io/skills/tahodev-cwa-weather.md and its manifest at https://skillstore.io/api/skills/tahodev-cwa-weather/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划,并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文,而不是读取完整页面时,请使用这些链接。

测试它

正在使用“cwa-weather”。 Show an example of a Taipei forecast summary.

预期结果:

Historical example from the skill, not a current forecast: Taipei City, September 14, 2026, daytime. Cloudy with brief showers; rain probability 30%; temperatures 25-30 C.

正在使用“cwa-weather”。 Check Taipei weather without a CWA key.

预期结果:

A valid CWA authorization key is required. Obtain one from the CWA open-data platform, or use the separate taiwan-weather skill if available.

正在使用“cwa-weather”。 The township API returns every Taipei district despite my location filter.

预期结果:

The skill documents this behavior for township datasets. Retrieve the city response and select Daan District locally before summarizing its forecast periods.

安全审计

低风险
v1 • 2026/10/13 打开版本化报告

Most alerts are false positives from Markdown backticks, official CWA links, dataset descriptions, and readable multilingual text. Predictable temporary files create overwrite and forecast-tampering risks, while command-line authorization URLs can expose API keys. No evidence found of prompt injection, malicious exfiltration, or concealed executable content.

1
已扫描文件
76
分析行数
3
复核项
0
已忽略误报

已确认安全问题 (1)

低
API Key Exposure Through Command-Line URLs
Both curl examples place the authorization key in a URL argument. Substituting a real key can expose it through process listings or command logs.
Both examples visibly put Authorization in the command-line URL. The secrecy guidance excludes replies and commits but does not prevent process-argument exposure.
能力复核项 (3)

这些是真实的本地能力,对此技能可能是预期行为,因此需要复核,但不会按已确认恶意行为计分。

中
Temp directory access
curl -sm 30 'https://opendata.cwa.gov.tw/api/v1/rest/datastore/F-C0032-001?Authorization=<授權碼>&locat
curl writes to the predictable shared path /tmp/cwa.json without exclusive creation. A local attacker could pre-create a symlink and redirect the write.
中
Temp directory access
curl -sm 30 'https://opendata.cwa.gov.tw/api/v1/rest/datastore/F-D0047-061?Authorization=<授權碼>' -o /
curl writes to the predictable shared path /tmp/cwa_tpe.json without exclusive creation. A pre-existing symlink could cause an unintended file overwrite.
中
Temp directory access
jq -r '.records.Locations[0].Location[] | select(.LocationName=="大安區") | .LocationName' /tmp/cwa_tpe
jq trusts /tmp/cwa_tpe.json without ownership or freshness checks. A local attacker controlling that predictable file could substitute misleading forecast data.
审计者: codex
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据,不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/tahodev-cwa-weather/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/tahodev-cwa-weather/security.svg)](https://skillstore.io/skills/tahodev-cwa-weather?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/tahodev-cwa-weather?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tahodev-cwa-weather/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/tahodev-cwa-weather.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

tahodev. (2026). cwa-weather security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/tahodev-cwa-weather/audits/1

BibTeX 引用

@techreport{tahodev-tahodev-cwa-weather-2026, author = {tahodev}, title = {cwa-weather security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/tahodev-cwa-weather/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "cwa-weather security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "tahodev" date-released: "2026-10-13" url: "https://skillstore.io/skills/tahodev-cwa-weather/audits/1" identifiers: - type: other value: "skillstore:tahodev-cwa-weather:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
55
架构
85
可维护性
87
内容
65
社区
83
规范符合性

你能构建什么

Plan a Local Trip

Review temperature ranges and rain probabilities for the next 36 hours before visiting a Taiwan county.

Compare Work Locations

Compare forecast periods across multiple counties to support outdoor work scheduling.

Prepare a District Weather Brief

Retrieve a township dataset, select the requested district, and summarize conditions with explicit forecast times.

试试这些提示

Check One County
Check Taipei City weather for the next 36 hours using my configured CWA key. Include forecast periods, temperatures, and rain probabilities.
Compare Two Counties
Compare Taipei City and New Taipei City forecasts for tomorrow. Match forecast periods and include rain probability, temperature ranges, and comfort indicators.
Select a Township Forecast
Retrieve Taipei township forecasts and filter locally for Daan District. Summarize available periods and weather fields without exposing my configured authorization key.
Handle Forecast Failures
Query county and township forecasts for Taipei using private temporary files. Validate responses, limit retries, and report failures without substituting historical data.

最佳实践

  • Keep authorization keys outside replies, commits, process arguments, and logs.
  • Use private temporary storage or direct parsing, and validate each API response before summarizing.
  • Include forecast periods, verify dataset identifiers, and distinguish official forecasts from alternate sources.

避免

  • Presenting historical examples or failed responses as current weather.
  • Assuming township locationName parameters reliably filter every district.
  • Using this forecast skill as a substitute for authoritative emergency warnings.

常见问题

Do I need an API key?
Yes. Obtain a CWA authorization key from its open-data platform. Missing or invalid keys produce authorization errors.
Which forecast areas are supported?
The instructions cover county forecasts and township datasets. Taipei township access is documented; other county dataset IDs require catalog verification.
What weather details can I request?
County forecasts include weather conditions, rain probability, minimum and maximum temperatures, comfort indicators, and forecast periods.
Can this skill retrieve emergency warnings?
Emergency warnings are outside its main scope. It refers to the separate taiwan-weather skill and official CWA announcements.
Why do township results include other districts?
The documented township request returns all districts despite locationName. Select the requested district locally after downloading the dataset.
What happens when the API fails?
Use a 30-second timeout and one or two retries for connection or server failures. Report unresolved errors without inventing forecasts.

开发者详情

作者

tahodev

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

引用

2aab20a3878daa05021884e089a7dd7739e08581

维护新鲜度

2026/10/13

使用量

0 次下载 · 0 次浏览

文件结构

📄 SKILL.md

tahodev 的更多技能

查看全部
查看全部