Ulanzi TC001

Control the Ulanzi TC001 (Pixel Clock) over local HTTP. Use to list tc1/tc001 commands, read status, enable/disable gadgets (time/date/youtube/matrix/etc.),...

This skill appears to do exactly what it says: control a TC001 pixel clock over local HTTP. Before installing, verify the device IP in config.json (or the TC001_HOST env) is correct and points to your device on the local network. Do not set TC001_HOST/ AWTRIX_HOST to unknown public hosts (the script will send HTTP GET/POST to whatever host you configure). If you plan to use a YouTube API key with the device, keep that key private (the skill does not request it but may read or set it in the device's app fields). If you want extra safety, inspect the full scripts/tc001.py file locally (it uses urllib only, no shell execution or remote code downloads).

Type: OpenClaw Skill Name: ulanzi-tc001 Version: 1.0.3 The skill's primary purpose is to control a local Ulanzi TC001 device via HTTP, which is benign. However, the `scripts/tc001.py` file contains a critical vulnerability: it disables SSL certificate verification (`ssl._create_unverified_context()`) when making external API calls to `geocoding-api.open-meteo.com` and `api.open-meteo.com` in the `cmd_weather` function. This exposes the skill to Man-in-the-Middle attacks, allowing potential interception or alteration of weather data before it's sent to a local Awtrix device. No evidence of intentional malicious behavior like data exfiltration or persistence was found.