smartpi-iot

智能公元 IoT 设备控制插件。可控制灯光、加湿器、窗帘等设备，支持查询设备状态。

Before installing: 1) Note the mismatch between the registry summary (which declared no required env vars) and the SKILL.md (which requires SMARTPI_TOKEN and SMARTPI_DEVICE_KEY). Confirm the platform will store those secrets in a secure secret store rather than exposing them in logs or shell history. 2) Verify the API hostname (https://mcp.aimachip.com) is legitimate and intended for your SmartPi devices — the skill homepage is smartpi.cn but the API uses aimachip.com, which could be legitimate (third‑party backend) but should be confirmed. 3) Prefer creating a short-lived or least-privilege token for this skill and avoid reusing high‑privilege tokens (e.g., admin keys). 4) Because the SKILL.md suggests writing a script to ~/.openclaw/workspace, review that file after creation and ensure it has appropriate permissions (no world-readable tokens). 5) If you allow autonomous invocation, be aware the agent could call the API whenever triggered; consider limiting invocation or testing first with a non-critical device. If anything about the origin or endpoints cannot be verified, treat the skill as untrusted and do not provide real credentials.

Type: OpenClaw Skill Name: smartpi-iot Version: 1.0.0 The smartpi-iot skill provides standard IoT device control functionality for SmartPi devices. It uses curl to interact with the mcp.aimachip.com API, requiring a user-provided token and device key. The code and instructions in SKILL.md are consistent with the stated purpose and do not exhibit any signs of data exfiltration, malicious execution, or prompt injection.