SwitchBot Smart Home Control

Control SwitchBot smart home devices (curtains, plugs, lights, locks, etc.) via SwitchBot Cloud API. Use when user asks to open/close curtains, turn on/off lights/plugs, check temperature/humidity, or control any SwitchBot device.

This skill appears to do what it says, but review and follow these precautions before use: - Verify origin/trust: source is 'unknown' — only install/run if you trust the publisher or after you inspect the code (you have the script here). - Protect credentials: follow the SKILL.md advice (store token/secret in ~/.config/switchbot/credentials.json with chmod 600). Do not paste the token/secret into chat or public logs. - Consider secrets management: if you prefer, store credentials in a local secret manager and modify the script to read them securely instead of a file. - Limit exposure: run the script on a machine/network you control; it's benign but it can send commands to your devices. - Device ID privacy: updating TOOLS.md with device IDs is convenient but leaks device identifiers to your agent/tooling — avoid putting secrets or sensitive location info in that file. - Test safely: test with a non-critical device first (e.g., a light) to confirm expected behavior. - Rotate keys if compromised: if you accidentally expose the token/secret, rotate them via the SwitchBot app/dev settings. If you want a higher assurance level, request an auditable provenance (who published the skill) or run the script in an isolated environment before granting the skill regular use.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 1 The skill is designed to control SwitchBot smart home devices via their official Cloud API. It provides clear instructions in SKILL.md for users to obtain and securely store API credentials in `~/.config/switchbot/credentials.json` with appropriate file permissions (chmod 600). The `scripts/switchbot.py` script correctly implements HMAC-SHA256 authentication for API calls to `https://api.switch-bot.com/v1.1` and handles credential loading and API interactions securely. There is no evidence of data exfiltration, malicious execution, persistence, obfuscation, or prompt injection attempts against the agent to perform unauthorized actions. All actions are aligned with the stated purpose of device control.