MiGPT Xiaomi Assistant

Deploy MiGPT on a Xiaomi smart speaker to replace the built-in AI with a custom LLM-powered voice assistant. Use when: (1) setting up mi-gpt on a Xiaomi/Redm...

This skill mostly documents how to run MiGPT on Xiaomi speakers, but it includes an explicit MIoT authentication bypass that requires collecting browser cookies, Xiaomi passwords, and writing tokens to disk plus patching node_modules. Before using: (1) Verify the source repository and maintainer — prefer an upstream/official repo; (2) do not paste browser cookies or passwords into tools or agents you don't fully trust; collect credentials manually and store them securely (use a temporary account if possible); (3) avoid enabling debug (it will log env vars including API keys); (4) understand that the provided patches persistently alter installed packages and will be overwritten by updates — prefer patch-package or postinstall scripts and keep patches under version control; (5) consider alternatives that do not require auth bypass (e.g., configure device via official app, disable native voice replies in the Xiaomi app instead of cookie injection); (6) if you must proceed, inspect every line of the cookie-exchange and file-write code yourself and only run it locally on a machine you control. Additional useful information to raise confidence: a verifiable upstream project URL, evidence that the cookie-exchange method is an accepted/official workaround (not an exploit), or a clear statement about whether the skill ever transmits credentials to external servers (currently it stores them locally).

Type: OpenClaw Skill Name: migpt-xiaomi-assistant Version: 1.0.0 The skill provides instructions for deploying a custom AI assistant on Xiaomi speakers but includes high-risk procedures for bypassing security mechanisms. Specifically, 'references/miot-auth-bypass.md' describes how to manually extract and inject sensitive browser session cookies (including passport hashes and device IDs) into local configuration files to circumvent Xiaomi's security verification loops. Furthermore, 'references/patches.md' instructs the agent to modify third-party library code within 'node_modules' to skip authentication checks. While these actions are presented as workarounds for documented technical limitations of the MiGPT framework, the handling of session tokens and the modification of dependency code represent significant security risks that could be exploited if the environment is compromised.