安全扫描
OpenClaw
安全
high confidence本技能仅通过指令直接调用 DHMZ 公开 XML 端点(使用 curl),无需凭证或安装代码,行为与描述一致。
评估建议
此为仅指令的克罗地亚天气技能,通过 curl 从官方克罗地亚气象站获取公共 XML 数据。安装前请注意:(1)隐私:技能通过对话上下文推断城市(默认扎格勒布),可能无明确确认获取数据;(2)解析:建议使用 xmllint/xq 美化输出,但不会自动安装;(3)网络访问:代理将向多个域名发起 HTTP 请求,请确认信任这些域名;(4)如需查询前确认,请提供明确城市参数或禁用自动调用。技能整体合理,适合其目的。...详细分析 ▾
✓ 用途与能力
Name/description, required binary (curl), and the listed endpoints are consistent: the skill simply fetches public XML weather data from DHMZ and related Croatian sites. No credentials, unrelated binaries, or surprising config paths are requested.
ℹ 指令范围
SKILL.md instructs the agent to immediately fetch data (default Zagreb if no city provided) and to infer the city from conversation context instead of asking the user. That is coherent for an auto-serving weather skill but has a privacy/behavior implication: the agent may fetch data about an inferred location without explicit user confirmation. It does not instruct reading system files, environment variables, or contacting unexpected endpoints beyond the listed meteorological sites. It suggests optional tools (xmllint, xq) for parsing but does not require them.
✓ 安装机制
No install spec or downloadable code — instruction-only. This minimizes disk footprint and supply-chain risk.
✓ 凭证需求
No environment variables, secrets, or credentials requested. The skill does not ask for unrelated tokens or keys.
✓ 持久化与权限
always:false and default model-invocation allowed. The skill does not request permanent system presence or modify other skills. Note: allowing autonomous invocation means the agent can call the listed network endpoints when invoked without further user prompts — this is expected for such a skill.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/5
初始发布:克罗地亚天气数据技能
● 无害
安装命令 点击复制
官方npx clawhub@latest install dhmz-weather
镜像加速npx clawhub@latest install dhmz-weather --registry https://cn.clawhub-mirror.com
技能文档
克罗地亚气象水资源研究所 (DHMZ) 提供免费 XML API。所有数据为克罗地亚语,无需认证。
默认行为
当调用此技能时:- 若提供城市参数 (例如,
/dhmz-weather 萨格勒布): 立即获取并显示该城市天气 - 若无城市参数 : 从对话上下文推断城市(用户位置、之前提及的城市或项目上下文)。若无上下文,默认为萨格勒布
... (以下内容为技术指令、代码块和特定数据提取方法,保持原文未翻译) ...
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制