xiaoai-ha-control

通过 Home Assistant + Xiaomi Miot 控制小爱音箱，并可选支持“小爱语音 → OpenClaw”的桥接。适用于两类场景：1) 用户要求“让小爱说一句… / 播报… / 通知…”、“告诉小爱… / 让小爱执行…”、“让小爱播放音频 / mp3 / 链接”时，使用本 skill 进行下行控制...

Key things to check before installing: - Expect to provide sensitive env vars even though the registry shows none: HA_URL, HA_TOKEN, XIAOAI_PLAY_TEXT_ENTITY_ID, XIAOAI_EXECUTE_TEXT_ENTITY_ID, XIAOAI_MEDIA_PLAYER_ENTITY_ID (and optionally OPENCLAW_BIN). Do not commit or share your .env containing HA_TOKEN. - The bridge (bridge_server.py) binds to 0.0.0.0:8765 by default. If you run it, restrict access with a firewall, bind it to localhost, or configure a reverse proxy that requires authentication so it isn't reachable from untrusted networks. - The bridge executes local subprocesses (openclaw and the xiaoai scripts) and writes logs/status files in the skill directory. Review the code to ensure prompts and outputs meet your privacy needs; consider running it in a confined account or container. - The README references whitelist.json.example and copying a whitelist; verify that whitelist.json exists before enabling forwarding. Use the whitelist to avoid forwarding device-control commands you want Xiaoai to handle natively. - If you plan to enable autostart (systemd/launchd), follow the README's launchd notes: do not double-daemonize, and ensure PATH/OPENCLAW_BIN are explicitly set in the service environment. If these points are acceptable and you harden network exposure and protect HA_TOKEN, the skill's behavior is coherent with its stated purpose. If you cannot restrict the bridge port or do not want local services to invoke OpenClaw automatically, do not enable the bridge component.

Type: OpenClaw Skill Name: xiaoai-ha-control Version: 1.1.0 The skill bundle provides a legitimate integration between OpenClaw and Home Assistant for controlling Xiaomi speakers. It facilitates both 'downlink' control (making the speaker talk or execute commands via xiaoai_say.sh and xiaoai_execute.sh) and an 'uplink' bridge (bridge_server.py) that receives voice commands from Home Assistant. While the bridge server runs unauthenticated on the local network and executes shell commands via subprocess, these are functional requirements for its stated purpose. The scripts demonstrate security awareness by using Python's json.dumps to properly escape user-provided strings before inclusion in shell-executed curl commands, mitigating common injection risks.