Smart Home Unified

统一管理多品牌智能家居设备，支持语音控制、跨平台场景联动及AI节能优化和安全监控。

This skill appears to implement the advertised local Xiaomi and HomeKit adapters, but there are multiple red flags you should address before installing or providing secrets: - Do NOT paste Apple ID passwords or other credentials into a plaintext TOOLS.md file. If the tool truly needs secrets, request that the author implement encrypted local storage or use OS keyring / environment variables. - The README claims credentials are 'encrypted locally' but the code shows no encryption — ask the author to point to the code that performs encryption or to remove that claim. - The Xiaomi adapter uses a hardcoded IP (192.168.1.100) when creating a miio device; confirm whether that is a placeholder and ensure it won't attempt unexpected connections on your LAN. - Prefer to supply per‑device tokens (local tokens) rather than full account username/passwords; avoid providing Apple account passwords unless you fully trust and have audited the code and know why iCloud credentials are needed. - Audit third‑party packages (miio, hap-nodejs) and consider installing and running the skill in an isolated environment (VM or isolated network) first. Verify network traffic (no unexpected outbound connections) and confirm the tool truly operates only on your LAN if you rely on the 'local only' claim. - If you plan to use this for many devices or in production, request the author to remove plaintext credential instructions, implement secure storage, fix the hardcoded IP, and document any cloud endpoints or telemetry clearly.

Type: OpenClaw Skill Name: smart-home-unified Version: 1.1.0 The skill bundle is classified as suspicious due to its request for highly sensitive credentials, including full account passwords for Xiaomi and Apple ID (HomeKit), rather than restricted API tokens or OAuth. The code in 'platforms/xiaomi.js' and 'platforms/homekit.js' consists mostly of stubs and placeholders (TODOs), contradicting claims in 'SKILL.md' and 'README.md' that 'real API integration' is implemented. Furthermore, the bundle includes an excessive amount of verbose, likely AI-generated documentation (e.g., 'MARKETING_PLAN.md', 'PUBLISH_REPORT.md') that serves no functional purpose and may be intended to create a false sense of legitimacy for a 'credential-catching' shell.