smarthome

Control global smart home devices via Home Assistant (preferred) and Tuya Smart (fallback) with fuzzy name matching and local device caching.

Proceed with caution. The implementation aligns with controlling Home Assistant and Tuya, but there are red flags: (1) registry metadata (name/owner/version) differs from the internal _meta.json and README — this can indicate repackaging or poor publishing hygiene; (2) SKILL.md documents environment-variable setup that the script does not implement (the script only reads a config file); (3) the discovery command is a placeholder and may not populate the device cache as promised. Before installing, review scripts/smart.py locally and: (a) ensure you create the config file at ~/.config/universal-smarthome/config.json rather than relying on env vars, (b) inspect network endpoints you configure (the script will contact the HA URL you provide and the Tuya endpoint), (c) avoid pasting real production credentials until you’ve tested in a safe environment, and (d) consider running the script in an isolated host or container and reading the source to ensure no unexpected data-sending behavior. If you need higher assurance, ask the publisher to reconcile the metadata and update the documentation or provide a vetted release from a known homepage/source.

Type: OpenClaw Skill Name: smarthome Version: 1.0.0 The skill provides a legitimate utility for controlling Home Assistant and Tuya smart home devices. It manages credentials by storing them in a local configuration file (~/.config/universal-smarthome/config.json) and communicates only with user-defined endpoints or official Tuya APIs. The Python script (scripts/smart.py) implements standard HMAC-SHA256 signing for Tuya and REST API calls for Home Assistant without any evidence of data exfiltration, unauthorized remote execution, or malicious prompt injection.