weather-pulse 安全扫描报告 — 可信 | ClawSafe

5 /100

weather-pulse

Weather + Air Quality query tool using QWeather and WAQI APIs

Clean weather and air quality query tool with no security issues. Only accesses declared API endpoints and reads API keys from environment variables.

技能名称weather-pulse

分析耗时24.8s

引擎pi

✓

可以安装

This skill is safe to use. No action required.

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`NONE`	—	No file I/O operations in code
网络访问	`READ`	`READ`	✓ 一致	Only accesses api.waqi.info and {QW_HOST} (QWeather API)
命令执行	`NONE`	`NONE`	—	No subprocess/os.system/eval calls
环境变量	`READ`	`READ`	✓ 一致	Lines 51-54: os.environ.get for API keys
技能调用	`NONE`	`NONE`	—	No skill invocation
剪贴板	`NONE`	`NONE`	—	No clipboard access
浏览器	`NONE`	`NONE`	—	No browser automation
数据库	`NONE`	`NONE`	—	No database access

9 项发现

🔗

中危外部 URL 外部 URL

https://dev.qweather.com/docs

SKILL.md:4

🔗

中危外部 URL 外部 URL

https://aqicn.org/data-platform/token/.

SKILL.md:13

🔗

中危外部 URL 外部 URL

https://console.qweather.com

SKILL.md:22

🔗

中危外部 URL 外部 URL

https://aqicn.org/api/

SKILL.md:23

🔗

中危外部 URL 外部 URL

https://dev.qweather.com/docs/start/

SKILL.md:45

🔗

中危外部 URL 外部 URL

https://dev.qweather.com/docs/finance/pricing/

SKILL.md:45

🔗

中危外部 URL 外部 URL

https://aqicn.org/data-platform/token/#/

SKILL.md:51

🔗

中危外部 URL 外部 URL

https://aqicn.org/city/

SKILL.md:59

🔗

中危外部 URL 外部 URL

https://api.waqi.info/feed/

scripts/weather.py:159

目录结构

3 文件 · 23.3 KB · 687 行

Python 1f · 400L Markdown 1f · 282L JSON 1f · 5L

├─ ▾ 📁 scripts

│ └─ 🐍 weather.py Python 400L · 14.2 KB

├─ 📋 _meta.json JSON 5L · 132 B

└─ 📝 SKILL.md Markdown 282L · 9.0 KB

安全亮点

✓ Uses only Python standard library (urllib) - no external dependencies

✓ API credentials read exclusively from environment variables

✓ All network requests target only documented API endpoints

✓ No shell execution, subprocess, or system calls

✓ No file I/O operations beyond standard output

✓ No credential exfiltration or data theft patterns

✓ Comprehensive documentation in SKILL.md matches implementation

✓ No base64, eval, or obfuscation patterns detected

✓ Clean code with no hidden functionality