skill-create-pip

Control Ecovacs/DEEBOT robot vacuums via the Ecovacs IoT API. Use when the user wants to control a robot vacuum, check battery, start/stop/pause cleaning, re...

This skill appears to do what it claims (control Ecovacs vacuums). Before installing: (1) be aware the script stores your phone and password (MD5 or MD5-of-plaintext) plus token in ~/.ecovacs_session.json — protect that file (restrict file permissions) or remove the stored password after login if you prefer. (2) Traffic is sent to Ecovacs endpoints defined in the code; if you require higher assurance, verify those hostnames against official Ecovacs documentation or an official SDK/repo. (3) Because the session file contains credentials, delete or rotate them if you stop using the skill. (4) If you need stricter security, consider running the script in an isolated environment or inspect/modify the code to use a more secure secret store instead of a plaintext session file.

Type: OpenClaw Skill Name: skill-create-pip Version: 2.0.0 The skill is designed to control Ecovacs vacuum robots but exhibits suspicious metadata and insecure data handling. The `slug` in `_meta.json` is `skill-create-pip`, which is entirely unrelated to the Ecovacs functionality described in `SKILL.md`, suggesting a potential template error or misleading naming. Furthermore, `scripts/ecovacs.py` implements insecure credential persistence by storing the user's phone number and MD5-hashed password in a local plaintext file (`~/.ecovacs_session.json`). While these actions are functional for the stated purpose of maintaining a session with Ecovacs IoT endpoints (e.g., `api-app.dc-cn.cn.ecouser.net`), the storage of sensitive credentials in an accessible local file constitutes a significant security vulnerability.