Sony Tv

Control Sony Bravia TV via IP Control protocol. Send IRCC remote commands, open URLs in TV browser, kill apps, and run diagnostics. Use when controlling a So...

What to consider before installing or running this skill: - The skill does what it says (controls a Sony Bravia over the local network), but the package includes both client-side code (web UI) and a Node/express server. The SKILL.md says "No server required," yet the diagnostic flow expects a local server (http://192.168.50.170:3000) — verify whether you need to run that server and inspect test/src/server.js before running it. - The SKILL.md and helper script (tv.sh) include a hardcoded TV IP and PSK (19890801). Treat those values as sensitive: if these are your real credentials, replace them with environment variables or prompt-based input. If they are sample values, remove them from deployed artifacts to avoid accidental reuse or leaking real credentials. - Opening the diagnostic page on the TV causes the TV to fetch content from the specified host. If you run the included server, be aware it will expose a port on your network; review server code and run it in a safe environment (isolated LAN) if you decide to use it. - If you will run any included server code, inspect the server (test/src/server.js) and other Node files for logging, network callbacks, or code that might collect or forward diagnostic data. The provided files look legitimate (IRCC and JSON-RPC calls to the TV), but you should confirm there is no unexpected remote exfiltration before running. - Recommended actions: (1) Inspect test/src/server.js and tv.sh; (2) remove or replace hardcoded PSK/IP with configuration via env vars or prompts; (3) only run the server on a trusted/isolated network; (4) if you don't need the diagnostic page, you can use the curl examples or tv.sh helper directly against your TV. If you want, I can list the exact lines/files that contain the hardcoded PSK/IP and point out where the server is used so you can inspect them further.

Type: OpenClaw Skill Name: sony-tv Version: 1.0.0 The skill bundle is a comprehensive toolset for controlling Sony Bravia TVs via the IRCC-IP and REST API protocols. It includes a shell script (tv.sh), a Node.js client (SonyTVClient.js), and a web-based remote control interface with a diagnostic page (diag.html) designed to run on the TV's internal browser. While it includes high-risk capabilities such as opening arbitrary URLs on the TV and detecting proprietary Sony APIs (like DirectoryReader for USB access), these features are clearly aligned with the stated purpose of remote control and device diagnostics. The diagnostic data collection is limited to browser capabilities and is sent only to the local server (server.js). No evidence of malicious intent, data exfiltration from the host, or prompt injection was found.