Tuya Smart Home

Control Tuya/Smart Life smart home devices including pet feeders, lights, plugs, curtains via cloud API or local network. Use when: (1) controlling smart hom...

This skill appears to do what it says: control Tuya devices via cloud or local network. Before installing: (1) inspect or run the included scripts in a safe environment if you have doubts (the source is bundled and readable); (2) only provide your Tuya ACCESS_ID/ACCESS_SECRET or LOCAL_KEY/IP when needed and to a trusted runtime — these are real credentials that grant device control; (3) be aware the scan will probe your local network to find Tuya devices; and (4) the scripts use public pip packages (tinytuya, tuya-connector-python) — consider auditing those packages or installing in an isolated virtualenv. If you want tighter control, prefer local mode and avoid giving cloud credentials to untrusted hosts or agents.

Type: OpenClaw Skill Name: tuya-smart-home Version: 1.0.0 The skill is designed to control Tuya/Smart Life devices via cloud or local APIs, which inherently requires network access and handling of sensitive credentials (Tuya Access ID/Secret, Local Key). All code (`scripts/tuya_control.py`, `scripts/tuya_scan.py`) uses standard Python libraries (`argparse`, `json`) and legitimate third-party Tuya libraries (`tinytuya`, `tuya-connector-python`) for its stated purpose. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts in the `SKILL.md` or `references/tuya_api.md` files. While passing credentials via command-line arguments (as shown in `SKILL.md` examples) can pose a risk in certain environments (e.g., shell history, process lists), this is a common pattern for CLI tools and does not indicate malicious intent within the skill's code itself, which merely consumes the provided arguments.