SmartShift Advisor

Advises battery charge/discharge strategy using Amber prices, solar forecast, and inverter state to optimize energy flow and cost savings.

What to consider before installing: - Do not install until the skill metadata is fixed and documents exactly which credentials and paths it needs. The package currently omits declared env vars while the scripts expect AMBER_API_KEY and AMBER_SITE_ID, a Home Assistant token (or token file at ~/.openclaw/workspace/ha-smartshift/.ha_token), and INVERTER_URL/INVERTER_SN — sensitive values you should not supply blindly. - Review the scripts yourself. They call external services (Amber API, Open-Meteo) and your local HA/inverter endpoints, and they read/write under ~/.openclaw/workspace/ha-smartshift/. Ensure you are comfortable with that filesystem access and with recommendations being written back into Home Assistant via write_advice.py. - The SKILL.md embeds metadata requesting always-load (metadata.openclaw.always: true) even though the registry marks always:false. Ask the author to remove/justify always:true. Always-loaded skills increase exposure if they access credentials. - The inverter probe disables TLS verification to connect to INVERTER_URL; verify the inverter endpoint is a trusted local IP and consider securing it or adjusting the script to allow verifying a certificate. - If you proceed: run the scripts manually in a controlled environment (not auto-run) first, use least-privilege tokens (short-lived or limited-scope HA tokens), and do not expose high-privilege credentials to the skill until you are satisfied with behavior. - Ask the publisher (or upstream repo) for: an explicit requirements list (env vars and config.json schema), documentation of exactly which external endpoints are contacted, and confirmation that no data is exfiltrated beyond the stated services. If the author cannot provide clear answers, classify this skill as high-risk and avoid installing it.