功能描述

Control Devialet Phantom speakers via HTTP API. Use for: play/pause, volume control, mute/unmute, source selection, and speaker status. Requires DOS 2.14+ firmware. Works with Phantom I, Phantom II, Phantom Reactor, and Dialog.

使用说明 (SKILL.md)

Devialet Speaker Control

Name: Devialet Speaker Control
Author: jgm2025

Control Devialet speakers (Phantom, Mania) over your local network with Spotify integration.

Natural Language Commands

When the user says things like:

"Play Nines - Lick Shots on my speaker" → Search and play via Spotify
"Set speaker volume to 40" → Adjust volume
"Pause the music" → Pause playback
"What's playing?" → Check current track and status

Setup

Find your speaker's IP address (check router or Devialet app)
Set the DEVIALET_IP environment variable, or add to TOOLS.md:
```
## Devialet Speaker
- IP: 192.168.x.x
```
For Spotify integration: install Spotify desktop app, playerctl, and xdotool

Quick Usage

# Set your speaker IP
export DEVIALET_IP="192.168.x.x"

# Play a song (search and play)
./scripts/play-on-devialet.sh "Drake - God's Plan"

# Play by Spotify URI
./scripts/play-on-devialet.sh spotify:track:4YZNJOA9d8wiO5ELNY5WxC

# Pause / Resume
./scripts/play-on-devialet.sh pause
./scripts/play-on-devialet.sh resume

# Volume
./scripts/play-on-devialet.sh volume 50

# Status
./scripts/play-on-devialet.sh status

Requirements

Devialet speaker with DOS 2.14+ or SDOS 1.3+ firmware
Spotify integration (optional):
- Spotify desktop app running and logged in
- playerctl and xdotool installed (sudo apt install playerctl xdotool)
- Speaker set as Spotify Connect device (select once in Spotify app)

How It Works

Searches for track via Spotify desktop app (D-Bus/MPRIS)
Opens track URI in Spotify
Spotify Connect streams to Devialet
Devialet API controls playback/volume

Direct Devialet API

For non-Spotify control (replace $DEVIALET_IP with your speaker's IP):

# Volume (0-100)
curl -X POST -H "Content-Type: application/json" \
  -d '{"volume": 50}' \
  "http://$DEVIALET_IP/ipcontrol/v1/systems/current/sources/current/soundControl/volume"

# Play/Pause
curl -X POST "http://$DEVIALET_IP/ipcontrol/v1/groups/current/sources/current/playback/play"
curl -X POST "http://$DEVIALET_IP/ipcontrol/v1/groups/current/sources/current/playback/pause"

# Mute/Unmute
curl -X POST "http://$DEVIALET_IP/ipcontrol/v1/groups/current/sources/current/playback/mute"
curl -X POST "http://$DEVIALET_IP/ipcontrol/v1/groups/current/sources/current/playback/unmute"

# Get status
curl -s "http://$DEVIALET_IP/ipcontrol/v1/devices/current" | jq .

Supported Models

Phantom I, Phantom II, Phantom Reactor (DOS 2.14+)
Dialog
Mania (SDOS 1.3+)

API Reference

See references/api.md for complete endpoint documentation.

安全使用建议

This skill appears to implement what it claims, but it has transparency issues you should consider before installing: - It requires you to set DEVIALET_IP or DEVIALET_HOST (not declared in registry metadata). The scripts will fail without that. - For Spotify integration you must create a credentials file (~/.config/clawdbot/spotify.json) with client_id and client_secret and run an OAuth flow that saves tokens to ~/.config/clawdbot/spotify_token.json. These files contain secrets — review and protect them (file perms, backup policies). - The play script scrapes Google search results as a fallback to find Spotify track IDs; that sends your search queries to Google and is fragile. If you prefer, use the Spotify API script (spotify.sh) which uses official endpoints but requires proper OAuth setup. - The scripts assume a desktop environment (DBUS session, DISPLAY, xdotool, playerctl). They will not work on headless servers without adjustments. - No install-time downloads occur, but review the three scripts before running. If you don't want local credential files or outbound requests to Google/Spotify, do not enable Spotify integration — direct Devialet control via curl (documented in SKILL.md) works without those tokens. If you decide to proceed: inspect the scripts, run them in a restricted environment or sandbox first, and protect the credential files created by the auth flow (restrict permissions, do not check them into source control).

功能分析

Type: OpenClaw Skill Name: devialet Version: 1.0.0 The skill is classified as suspicious due to the use of `xdotool` in `scripts/play-on-devialet.sh`. While currently used for a benign purpose (simulating a 'Return' key press to interact with the Spotify desktop application), `xdotool` grants the agent the capability to perform arbitrary desktop automation, including simulating keyboard and mouse input. This high-risk capability, combined with `export DISPLAY=:0`, could be exploited via prompt injection to execute unauthorized actions on the user's graphical environment, even though there is no clear evidence of intentional malicious behavior within the provided files.

能力评估

ℹ Purpose & Capability

Name/description align with the included scripts: HTTP control of Devialet speakers and optional Spotify integration. However, the registry metadata declares no required env vars or config paths while the runtime instructions and scripts require DEVIALET_IP / DEVIALET_HOST and a Spotify credentials/token file — this mismatch is a design omission that reduces transparency.

ℹ Instruction Scope

SKILL.md and scripts stay within speaker-control/Spotify scope (curl to local Devialet endpoints, Spotify API calls, local D-Bus/xdotool/playerctl usage). The scripts read/write local config (~/.config/clawdbot/spotify.json and spotify_token.json), set DBUS env vars, and make outbound HTTPS requests (Spotify API, and a Google search as a fallback). Those actions are consistent with the feature set but the Google scraping (curl → grep) is an unexpected external web dependency and may leak search queries to Google.

✓ Install Mechanism

No install spec; this is instruction/script-only — nothing is downloaded or executed during install. That lowers install-time risk. The scripts assume standard command-line tools (curl, jq, playerctl, xdotool, dbus-send) but do not install them for you.

⚠ Credentials

The skill requires environment/config data not declared in registry metadata: DEVIALET_IP or DEVIALET_HOST and Spotify credentials (client_id/client_secret) stored at $XDG_CONFIG_HOME/clawdbot/spotify.json and tokens at spotify_token.json. Those files contain secrets (client_secret, refresh/access tokens) and are written to disk by the OAuth flow; the skill does not declare these required secrets nor explain storage permissions. The number/location of required config files is disproportionate to the metadata presented and should be disclosed.

ℹ Persistence & Privilege

always: false and no cross-skill/system-wide config modifications. The skill does persist Spotify tokens and credentials under ~/.config/clawdbot (created by the auth flow), which is reasonable for OAuth but is a persistent artifact that the user should review and protect. No evidence of attempts to modify unrelated skill configs or global system settings.

版本历史

v1.0.0

Initial release: Control Devialet Phantom/Mania speakers via HTTP API with Spotify integration

元数据

Slug devialet

版本 1.0.0

许可证 —

累计安装 3

当前安装数 3

历史版本数 1

常见问题