Weather embedded skill points at key-gated APIs (never works) — switch to a keyless service

[initializ-mk]

Problem

The bundled embedded weather skill (forge-skills/local/embedded/weather/SKILL.md) can never work as shipped. Its egress_domains allow only:

egress_domains:
  - api.openweathermap.org
  - api.weatherapi.com

Both require an API key — but the skill declares no key at all:

env:
  required: []
  one_of: []
  optional: []

So the two hosts the egress gate permits are exactly the two that reject an unauthenticated request. On top of that the tool bodies are prose-only (## Tool: weather_current … no runnable command / endpoint), so there is nothing wired to call even if a key existed. Net result: the skill is dead on arrival for every user who hasn't signed up for OpenWeather/WeatherAPI and manually threaded a key in — which the skill gives no way to do.

Fix

Repoint the skill at a weather service that needs no API key for at least a reasonable amount of free traffic, and give the tools an actual runnable curl invocation against that endpoint. Two good options:

Option A — wttr.in (simplest drop-in) ⭐ recommended

• Single host: wttr.in. Accepts a city name directly (wttr.in/London?format=j1 → JSON), so it maps 1:1 to the skill's existing location (string) input — no geocoding step.
• Keyless, free for reasonable traffic.
• Already blessed in-repo: the Skill Builder UI suggestion at forge-ui/static/app.js:2902 literally proposes "Create a weather lookup skill that uses curl to fetch weather data from wttr.in."
• egress_domains: [wttr.in].

Option B — open-meteo.com (structured, more robust)

• Forecast: https://api.open-meteo.com/v1/forecast?latitude=..&longitude=..&current=temperature_2m,relative_humidity_2m,wind_speed_10m&daily=temperature_2m_max,temperature_2m_min.
• City name → coordinates needs the separate geocoding host: https://geocoding-api.open-meteo.com/v1/search?name=London.
• Keyless, generous free tier for non-commercial use; clean structured JSON (better for the weather_forecast 1–7 day tool).
• egress_domains: [api.open-meteo.com, geocoding-api.open-meteo.com] (two hosts, because of the geocoding call).

Recommendation: wttr.in for the drop-in fix (single domain, city-name input, already referenced by our own UI). If we want reliable structured multi-day forecasts, use open-meteo and add the geocoding host.

Blast radius — the two domains are hard-coded in several places, keep them in sync

File	What to change
forge-skills/local/embedded/weather/SKILL.md	egress_domains + add runnable curl bodies to the two tools
forge-cli/internal/tui/steps/egress_step.go:187-188	the "api.openweathermap.org"/"api.weatherapi.com" → "weather skill" allowlist hints
forge-skills/local/scanner_test.go:41	fixture asserts api.openweathermap.org
.claude/skills/forge.md:1102	doc example uses egress_domains: [api.openweathermap.org]

(forge-plugins/channels/markdown/markdown_test.go also mentions openweathermap.org, but only as an unrelated example link in a Markdown-conversion test — leave it.)

Acceptance

• Weather skill fetches current + forecast with no API key out of the box.
• egress_domains lists only the keyless host(s) actually called; the two key-gated domains are gone.
• Each tool section has a runnable curl command against the chosen endpoint (not prose alone).
• egress_step.go hints, scanner_test.go fixture, and the forge.md example updated to match.
• gofmt + golangci-lint clean; forge-skills + forge-cli suites green.

[zaidoskate]

Hi @initializ-mk, I'd like to work on this. I'll go with Option A (wttr.in) since it's the drop-in fix — single domain, no geocoding step needed, and it's already referenced in the Skill Builder UI suggestion, so it keeps things consistent.

Plan:

Update egress_domains and add runnable curl bodies in weather/SKILL.md
Update the allowlist hints in egress_step.go
Update the fixture in scanner_test.go
Update the doc example in forge.md

I'll leave the markdown_test.go reference alone as noted. Will open a draft PR once I have something testable — let me know if you'd rather I go with Option B (open-meteo) instead.

[initializ-mk]

@zaidoskate go ahead and work on it. I'm assigning it to you.