Control and monitor a Loxone Miniserver (smart home) via HTTP API and real-time WebSocket. Use for querying room/device status (temperatures, lights), watching live events, and sending safe control commands.

This package appears to do what it says: communicate with a Loxone Miniserver via HTTP and WebSocket. Before installing or running: 1) Note the mismatch in docs—SETUP.md incorrectly claims only standard library; you must install requests and websockets (from PyPI) or otherwise ensure they exist. 2) The skill stores your Loxone username/password in a local config.json—follow the SETUP.md advice and restrict file permissions (chmod 600). 3) The skill will contact dns.loxonecloud.com if you use Cloud DNS and will talk directly to the configured Miniserver; only provide credentials/remote access you trust. 4) Control commands can have real-world effects—use the read-only defaults and only run control actions when you explicitly intend to (the scripts include a safe-rooms check). 5) Consider running the scripts in an isolated environment (virtualenv/container) and review the code yourself if you have sensitive network exposure requirements. If you want higher assurance, ask the publisher to fix the documentation about required Python packages and confirm the expected config file path.

Type: OpenClaw Skill Name: loxone Version: 1.3.3 The OpenClaw Loxone skill is classified as benign. The code and documentation are well-aligned with the stated purpose of controlling a Loxone smart home system. Key indicators for this classification include explicit instructions in `SKILL.md` and `SETUP.md` for the AI agent to 'Treat as read-only by default' and only use control commands 'when explicitly requested', demonstrating a focus on safety. Input sanitization is present in `scripts/loxone.py` and `scripts/loxone_client.py` for command values and UUIDs, mitigating injection risks. All network calls are directed to the Loxone Miniserver or its Cloud DNS resolution service, with no evidence of data exfiltration to unauthorized external endpoints. There are no signs of obfuscation, persistence mechanisms, or arbitrary code execution.