xiaodu-iot

小度智能设备控制技能。用于控制小度音箱、IoT设备、查看设备列表、语音播报等。当用户需要控制小度智能设备、查询设备状态、发送语音指令或管理智能家居时使用此技能。

Before installing or running this skill: - Inspect and verify credentials: the skill requires a Baidu/DuerOS ACCESS_TOKEN but the metadata doesn't declare it. Do not paste tokens into scripts; store them securely and confirm where the token is read from (mcporter config or env). - Check required tooling: ensure mcporter, jq, and npx are present and trusted. npx will fetch the 'dueros-iot-mcp' package at runtime — review that package's source before allowing it to be fetched/executed. - Review file writes: the scripts create/overwrite files under your home workspace (logs, device lists, and MEMORY.md). If you do not want device identifiers or control logs persisted, do not run the update scripts or run them in a sandboxed environment. - Confirm paths and portability: files reference inconsistent paths (~/openclaw/workspace vs $HOME/.openclaw/workspace) and use sed -i '' (macOS style) which may behave unexpectedly on Linux — test in a safe environment first. - Camera/resource capabilities: reference docs mention xiaodu_take_photo and push_resource_to_xiaodu (push images/audio/video). If your devices have cameras or can render resources, consider the privacy implications and ensure you trust the endpoints and tokens used. Recommendations for the author or maintainer before you trust this skill: - Add requires.env entries (e.g., ACCESS_TOKEN) and declare required binaries (mcporter, jq, npx). - Provide an explicit install spec or a list of runtime dependencies and the exact npm package to be installed, plus a checksum or source link for the package. - Make persistence explicit and optionally configurable (e.g., allow choosing workspace directory or a dry-run mode; do not silently update MEMORY.md). If you are unsure or cannot verify the external npm package and token handling, run the skill only in an isolated environment (VM/container) and do not provide long-lived credentials.

Type: OpenClaw Skill Name: xiaodu-iot Version: 1.0.0 The skill bundle is a well-structured integration for controlling Xiaodu (Baidu) smart home devices and speakers via the Model Context Protocol (MCP). It provides utility scripts for device discovery (update_devices.sh), batch IoT control (batch_control.sh), and voice broadcasting (speak_message.sh), all of which use standard tools like mcporter and jq. While the skill requires shell and network access to interact with the Xiaodu ecosystem, its behavior is strictly aligned with its stated purpose, and no evidence of data exfiltration, credential theft, or malicious intent was found.