petkit-monitor

小佩宠物设备监控 - 获取喂食器、猫砂盆、饮水机、净化器状态

Do not use the included config.json credentials. The package ships a config.json with a phone number and password — treat this as leaked credentials. Before installing: remove or replace config.json, configure your own account via the --configure option, and verify you own the account you plan to use. Be aware the skill logs into PetKit using a reverse-engineered API (may sign out the mobile app and could break if API changes); review and trust the petkitaio library before installing. If the included credentials are yours, rotate the password immediately. If you don't control the account, do not use those credentials and consider the possibility that the repository unintentionally contains someone else's secrets.

Type: OpenClaw Skill Name: petkit-monitor Version: 1.0.0 The skill bundle contains hardcoded plaintext credentials (a Chinese phone number and password) in the 'config.json' file, which constitutes a significant security risk and a credential leak. While the Python script ('petkit_monitor.py') appears to be a functional tool for monitoring PetKit devices using the legitimate 'petkitaio' library, the inclusion of specific account details in a shared bundle is highly irregular. No evidence of intentional data exfiltration to third-party servers or malicious backdoors was found in the code logic.