Advanced weather from free OpenMeteo API: historical data, detailed variable selection, model choice, past-days, and in-depth forecasts. Use when the user as...
Security Analysis
high confidenceThe skill's requirements and runtime instructions match its stated purpose (calling the openmeteo CLI to fetch advanced weather data); nothing requested is disproportionate or unrelated.
Name/description (advanced Open-Meteo access) match the declared requirement (the openmeteo CLI). No unrelated binaries, env vars, or credentials are requested.
SKILL.md limits actions to running the openmeteo CLI and instructs safe practices (always use --llm; quote user-provided values). One behavior to note: the skill says to use the user's default city/country from session context when location isn't supplied, which legitimately requires access to user session metadata (location preference). This is coherent for convenience, but it means the agent may read session/profile context to choose a location.
Instruction-only skill — no install spec and no code files. The README includes typical install instructions for the openmeteo-sh CLI (Homebrew, apt repo, or build-from-source). Those are user-run actions and not executed by the skill itself. If you plan to install, trust the listed repository before adding an APT repo or running commands that modify system package sources.
No environment variables or credentials are requested. The skill uses a public API (Open-Meteo) that requires no API key; network access is limited to open-meteo domains per the README.
always:false and user-invocable:true. The skill does not request persistent or elevated privileges and does not modify other skills' configs. Autonomous invocation is allowed by default but not elevated here.
Guidance
This skill is coherent and appears to do what it says: call the openmeteo CLI to fetch advanced weather data. Before enabling/installing it: 1) Ensure you trust the openmeteo-sh project (inspect the GitHub repo or install from a trusted package manager). The README shows adding a third‑party APT tap — adding package sources and installing packages requires trust in that publisher. 2) The agent will run shell commands it constructs; SKILL.md advises quoting user inputs to reduce shell-injection risk — confirm the agent honors that rule and avoid passing untrusted shell fragments. 3) The CLI will make HTTPS requests to Open-Meteo domains (api.open-meteo.com, archive-api.open-meteo.com, geocoding-api.open-meteo.com). No credentials are requested. 4) If you don’t want the agent to use session profile data (default city/country), specify locations explicitly when asking for weather. Overall: coherent and proportionate; install only if you’re comfortable installing the openmeteo-sh CLI from the linked source.
Latest Release
v1.2.2
Version 1.2.2 - Updated conversational examples to clarify that city/country context should be taken from the session, not USER.md. - Minor edits for clarity and consistency in documentation wording. - No functional or code changes detected.
More by @lstpsche
Published by @lstpsche on ClawHub
