Midea Cloud Control

Connect and control Midea devices through the Midea cloud with a local cached account/device config. Use when a user wants to connect a Midea account, list d...

This skill appears to do what it claims, but review and take these precautions before installing or running it: 1) Inspect the two generated files (generated-config-store.md and generated-midea-skill-cli.md) yourself — they are included in the package and will be written and executed locally. 2) Be aware the skill stores your account and password in plaintext at ~/.openclaw/midea-cloud-control/config.json; only proceed if you accept that storage risk, or modify the code to use encrypted storage or the OS credential store. 3) Ensure the runtime environment has the required Python packages (midealocal and aiohttp) and the 'uv' runner (or adjust the commands to use your Python). The skill metadata does not declare these dependencies. 4) Run the skill in an isolated environment (virtualenv, container, or throwaway account) if you want to limit blast radius. 5) After use, consider deleting the config.json file if you no longer want credentials stored. 6) If you need stronger guarantees, prefer a skill that uses OAuth or official SDK flows rather than storing passwords, or verify the midealocal package version/source before use.

Type: OpenClaw Skill Name: midea-cloud-control Version: 1.0.0 The skill stores Midea cloud credentials (account and password) in plain text in a local configuration file (~/.openclaw/midea-cloud-control/config.json), which is a significant security vulnerability. It also employs a 'bootstrap' pattern in SKILL.md that requires the AI agent to write and execute Python code from markdown blocks (generated-midea-skill-cli.md), a high-risk execution flow. While the code logic appears to align with the stated purpose of controlling appliances via the midealocal library, the insecure handling of sensitive user data is a critical flaw.