pugoing-smart

提供 Pugoing 中控平台的常用 API 调用能力，用于查询区域、主机、设备，以及通过自然语言控制设备。

This skill's code and README expect you to provide PUGOING_API_KEY (sent as X-API-Key) and optionally PUGOING_BASE_URL, but the registry metadata claims no credentials are required — treat that as an inconsistency. Before installing or configuring: (1) confirm the intended Pugoing server URL and only set PUGOING_API_KEY if the endpoint is trusted; (2) be aware the client will make arbitrary HTTP requests (including to full URLs you pass), so it can be used to reach internal network hosts; (3) note the example JSON field "auth":"agent" is unused by the client — verify any orchestration around this skill correctly provides authentication via PUGOING_API_KEY; (4) if you need stronger assurance, ask the publisher to update registry metadata to declare PUGOING_API_KEY as the primary credential and to explain expected trust boundaries. If the metadata is corrected and the API key usage is intentional for the documented platform, the main concern is resolved; otherwise treat the mismatch as a warning sign.

Type: OpenClaw Skill Name: pugoing-smart Version: 1.0.2 The skill bundle provides a legitimate API client for the Pugoing Smart platform, allowing an agent to manage IoT devices and hosts. The core logic in `client.py` is a straightforward wrapper for Python's standard `urllib` library, and the instructions in `SKILL.md` are consistent with the stated purpose of the tool. No evidence of malicious intent, data exfiltration, or unauthorized execution was found.