← Back to Skills Marketplace
122
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install smart-control-skill
Description
Control smart home devices configured in Smart Plus APP. Use when you need to: (1) Query devices and scenes (lights, AC, switches), (2) Control device power...
Usage Guidance
This package appears to contain a legitimate MXCHIP client that needs your MXCHIP_OAUTH_TOKEN to control devices. Before installing: (1) verify the publisher — confirm the GitHub URL and website are genuine and match the registry owner, (2) confirm why the platform metadata listed no required env vars (this mismatch could be a packaging error or an attempt to hide the token requirement), (3) only provide an OAuth token with minimal scope and rotate it after testing, (4) run the code in a sandbox or review the full script yourself (it appears to call only the MXCHIP API, but verifying there is no hidden exfiltration is prudent), and (5) prefer installing a skill from the official MXCHIP or platform-verified publisher rather than an unknown owner id. If you already provided a token and are unsure, revoke/rotate it and check MXCHIP account logs for unexpected activity.
Capability Analysis
Type: OpenClaw Skill
Name: smart-control-skill
Version: 1.0.2
The skill is a legitimate integration for controlling smart home devices via the MXCHIP MCP service. The Python client (mxchip_mcp_client.py) implements standard JSON-RPC 2.0 communication with official MXCHIP endpoints (app.api.cloud.mxchip.com) and requires a user-provided OAuth token. No evidence of data exfiltration, malicious execution, or prompt injection was found; the code and instructions are strictly aligned with the stated purpose of home automation.
Capability Assessment
Purpose & Capability
The code, SKILL.md, and README all describe an MXCHIP MCP client that legitimately needs an OAuth token to call MXCHIP endpoints — that is coherent with the stated purpose. However, the registry metadata provided to the platform lists no required environment variables and lists an unknown owner id, while skill.json and docs declare MXCHIP_OAUTH_TOKEN as required and the owner as MXCHIP. The homepage/source are marked unknown in the registry even though files claim official MXCHIP URLs. These provenance/metadata mismatches are unexpected and should be confirmed with the publisher.
Instruction Scope
SKILL.md and the included Python SDK instruct the agent only to use the MXCHIP OAuth token and call the MXCHIP MCP API endpoints; there are no instructions to read unrelated system files, search the host, or exfiltrate data to third-party endpoints. The runtime behavior (JSON-RPC over HTTPS to app.api.cloud.mxchip.com) matches the declared functionality.
Install Mechanism
There is no install spec (instruction-only), which is lower risk. The package includes a Python client and requirements.txt (requests). This is consistent with the SKILL.md pip install step, but the manifest lacks an explicit install mechanism — ensure your agent environment will install or sandbox the bundled code before execution. No external/untrusted download URLs or archive extraction are present.
Credentials
The skill legitimately requires a single sensitive credential (MXCHIP_OAUTH_TOKEN) to authenticate to MXCHIP's API; that is proportional to its purpose. However, the top-level registry metadata in the provided package claims 'required env vars: none' while skill.json and SKILL.md state MXCHIP_OAUTH_TOKEN is required. That metadata mismatch is a red flag about the packaging or publisher authenticity. Treat any OAuth token as sensitive and verify token scope before use.
Persistence & Privilege
The skill does not request always:true or other elevated persistence. disable-model-invocation is false (normal), and there is no code that attempts to modify other skills or global agent settings. No excessive privileges are requested in the package.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install smart-control-skill - After installation, invoke the skill by name or use
/smart-control-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
Version 1.0.2 of smart-control-skill
- No file changes detected between this version and the previous version.
- No user-facing updates, bug fixes, or feature changes.
v1.0.1
Version 1.0.1
- Added skill.json file to the project.
- No changes made to functionality or documentation content.
v1.0.0
Initial release of mxchip-smart-control skill.
- Provides control of smart home devices configured in the Smart Plus APP via MXCHIP MCP protocol (JSON-RPC 2.0 over HTTP).
- Supports querying devices and scenes, device power control (on/off), air conditioner control (temperature, mode), and scene triggering.
- Requires MXCHIP_OAUTH_TOKEN environment variable for authentication.
- Includes Python usage examples and error handling guidance.
- Detailed documentation for all supported actions and device categories.
Metadata
Frequently Asked Questions
What is smart-control-skill?
Control smart home devices configured in Smart Plus APP. Use when you need to: (1) Query devices and scenes (lights, AC, switches), (2) Control device power... It is an AI Agent Skill for Claude Code / OpenClaw, with 122 downloads so far.
How do I install smart-control-skill?
Run "/install smart-control-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is smart-control-skill free?
Yes, smart-control-skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does smart-control-skill support?
smart-control-skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created smart-control-skill?
It is built and maintained by kagxin (@kagxin); the current version is v1.0.2.
More Skills