小度控制

当用户要连接、验证、排障或控制小度智能屏 MCP 与小度 IoT MCP 时使用，包括配置 mcporter、列设备、文本播报、语音指令、拍照、资源推送，以及灯光/空调/风扇/窗帘/电视机顶盒/投影/扫地机/门锁等 IoT 控制与场景触发。

This skill appears coherent: it needs mcporter and an ACCESS_TOKEN to talk to your 小度 MCP servers and uses local scripts to run mcporter calls. Before installing: 1) Treat ACCESS_TOKEN like any sensitive token — give it least privilege and ensure it is stored only in your mcporter config (not pasted into chats). 2) Review ~/.mcporter/mcporter.json to confirm the configured servers and headers. 3) Be aware that the IoT path uses `npx -y dueros-iot-mcp` which will download and run an npm package the first time — if you require tighter supply-chain control, preinstall and vet that package locally. 4) The skill will write device snapshots to a workspace directory (default ~/.openclaw/workspace/xiaodu-control); remove or secure those files if they contain data you don’t want saved. 5) When using resource URLs (images/videos), only provide trusted URLs — the device or MCP may fetch them. If you want extra assurance, run the included test-cases locally (as documented) with a throwaway token or in a controlled environment first.

Type: OpenClaw Skill Name: xiaodu-control-official Version: 1.0.8 The xiaodu-control-official skill bundle is a legitimate integration for managing Xiaodu (DuerOS) smart screens and IoT devices via the Model Context Protocol (MCP). It provides a suite of Bash and Python scripts (e.g., control_iot.sh, speak.sh, device_resolver.py) that wrap the mcporter CLI to perform device discovery, media playback, and home automation tasks. While the skill includes sensitive capabilities such as camera access (take_photo.sh) and media pushing, these are documented features of the target hardware. The bundle includes extensive documentation, security best practices for token management, and lacks any indicators of data exfiltration, unauthorized persistence, or malicious intent.