📦 js-hanoi-air — 越南空气监测
v1.0.0高性能 Node.js 模块，实时抓取并解析越南全国空气质量指数，支持省市级本地化映射、容错重试与缓存，输出标准化 JSON，便于嵌入仪表盘与告警系统。
0· 84·0 当前·0 累计
by 下载技能包
最后更新
2026/4/10
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill's behavior (query WAQI and print results) matches its description, but it includes a hard-coded WAQI API token in the code while declaring no credentials — that mismatch is suspicious. Before installing: (1) Treat the embedded token as potentially sensitive: verify its origin (is it a public demo token?) and rotate or remove it if it belongs to your organization. (2) Prefer a version that accepts the token via a documented environment variable (e.g., WAQI_TOKEN) rather than hard-codin...详细分析 ▾
✓ 用途与能力
Name/description match the code and instructions: a Node.js script that queries the WAQI API for Vietnamese cities and returns AQI and simple health interpretation. No unrelated binaries, services, or capabilities are requested.
ℹ 指令范围
SKILL.md limits runtime behavior to running the included Node script and outbound access to api.waqi.info. The instructions do not ask the agent to read unrelated files or send data to other endpoints. Note: the package explicitly embeds full source, so runtime behavior is visible and limited to network calls to WAQI.
✓ 安装机制
There is no install spec; this is instruction-plus-source only. Nothing is downloaded or written by an installer, which lowers install-time risk.
⚠ 凭证需求
The code contains a hard-coded WAQI_TOKEN string (506d32... ) but the skill metadata declares no required environment variables or primary credential. Embedding a credential in source and failing to declare it is disproportionate and a secret-management red flag: it could be a leaked/stale personal token or a deliberate attempt to hide a credential. The script has network egress to api.waqi.info (expected) and does not contact other endpoints.
✓ 持久化与权限
Skill is user-invocable, not always-enabled, and does not request elevated or persistent system privileges or modify other skills. It only executes a single one-off Node.js process.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/10
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install js-hanoi-air
镜像加速npx clawhub@latest install js-hanoi-air --registry https://cn.longxiaskill.com镜像同步中