小爱音箱语音播报

小爱音箱语音播报。一句话让小爱说话，无需编写代码，支持定时提醒、远程喊话、家庭传话。

Before installing or running this skill: 1) Treat the MI_USER/MI_PASS credentials as sensitive — avoid storing plaintext passwords in ~/.zshrc or cron lines; prefer ephemeral environment variables or an account with limited scope. 2) Verify the upstream SDK (https://github.com/Yonsm/MiService) yourself before allowing the skill to clone/import it — review its code for unexpected network calls or exfiltration. 3) Prefer running the skill in an isolated environment (container/VM) if you must test it, so that the runtime clone can't affect your host. 4) Note the registry metadata omission: the skill actually requires MI_USER/MI_PASS though metadata lists none — treat metadata as unreliable. 5) If you accept the risk, consider modifying the code to avoid cloning into /tmp automatically and to prompt for credentials at runtime instead of persisting them. 6) The unicode-control-chars flag in SKILL.md is unusual — inspect SKILL.md for hidden characters before trusting automatic evaluation tools.

Type: OpenClaw Skill Name: xiaoai-speaker Version: 1.0.2 The skill handles sensitive Xiaomi account credentials (MI_USER, MI_PASS) and relies on a high-risk dependency management pattern. Specifically, scripts in the `scripts/` directory hardcode a search path to `/tmp/MiService`, a world-writable directory, which is vulnerable to local module hijacking. Furthermore, while `SKILL.md` claims the skill 'automatically installs' dependencies via `git clone` at runtime, the provided code lacks this logic, creating a discrepancy that might induce an AI agent to execute untrusted shell commands to satisfy the dependency.