Agent Economy ReportAgent Economy ReportSAFE version 1.0.0 · audited 2026-09-09
This is a short documentation-style skill that tells an agent how to fetch weather using two free public services, wttr.in and Open-Meteo, via curl commands. It contains no scripts, no credentials, no installation steps, and no file writes other than an optional example that saves a weather PNG to /tmp. The only network destinations are the two documented weather APIs, both of which fit the stated purpose. Nothing in the package tries to read secrets, redirect payments, persist itself, or override the agent's other rules. The main real-world consideration is that any location the user asks about is sent to a third-party service, which the skill card itself acknowledges.
| Declared purpose | Get current weather and forecasts without requiring an API key, using wttr.in and Open-Meteo. |
| Observed behavior | Provides example shell (curl) commands querying wttr.in and api.open-meteo.com, plus format-code documentation. One example writes an image to /tmp/weather.png. No other actions, no data collection, no obfuscation. |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | Outbound HTTP requests to wttr.in (SKILL.md line 16) and https://api.open-meteo.com (SKILL.md line 44) — both are the declared weather sources. |
| shell | needed | Instructs the agent to run curl commands in bash; curl is declared as a required binary in the front matter (SKILL.md line 5). |
| filesystem_write | needed | One optional example writes a weather image to a temp path: 'curl -s "wttr.in/Berlin.png" -o /tmp/weather.png' (SKILL.md line 38). Scoped to /tmp, no sensitive paths. |
| severity | finding |
|---|---|
| info | Outbound request to wttr.in over plain HTTP-style URL The example omits an explicit https:// scheme, so curl defaults to http:// for wttr.in. Weather queries are non-sensitive but the requested location is transmitted unencrypted unless the user adds https://. SKILL.md:16 curl -s "wttr.in/London?format=3" |
| info | Writes a downloaded file to /tmp Optional example downloads remote content to /tmp/weather.png. Limited to a temporary path and consistent with the skill's purpose; the file is not executed. SKILL.md:38 - PNG: `curl -s "wttr.in/Berlin.png" -o /tmp/weather.png` |
| info | Second third-party weather endpoint Coordinates supplied by the user are sent to api.open-meteo.com over HTTPS. Matches the declared fallback source; no credentials or other data are attached. SKILL.md:44 curl -s "https://api.open-meteo.com/v1/forecast?latitude=51.5&longitude=-0.12¤t_weather=true" |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.open-meteo.com | not in the service index | SKILL.md:44 |
| clawhub.ai | not in the service index | skill-card.md:7 |
| open-meteo.com | not in the service index | SKILL.md:49 |
| wttr.in | not in the service index | SKILL.md:4 |
| Binaries invoked | bash, curl |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 49 | 1ca0c8d768ad603e… |
_meta.json | 6 | 439e41242b257277… |
skill-card.md | 40 | 9bc82d1f20519f46… |
For agents
JSON: https://agenteconomy.report/k/weather.audit.json · badge: https://agenteconomy.report/k/weather.audited.svg ·
skill rating: /k/weather · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).