华米(Zepp/原小米)运动刷步数

华米运动(Zepp/小米运动)自动刷步数技能，支持多账号管理。当用户提到刷步数、修改运动步数、华米运动、小米运动、手环步数时触发。

This skill implements exactly what it claims (automatically submitting steps), but it requires you to provide real account usernames and passwords and stores them in config.json in plaintext. Before installing or running it: (1) review the scripts yourself — especially the large encoded payload in huami.py — to ensure there is no unexpected network/callback behavior; (2) avoid using your primary accounts (use a throwaway/test account); (3) set strict file permissions (chmod 600 config.json) and run on an isolated/local machine if possible; (4) be aware that automating step submissions may violate Huami/Zepp terms of service and could lead to account action; (5) if you plan to use cron, understand that it will run autonomously with stored credentials; and (6) if you are uncomfortable auditing the code, do not provide real credentials.

Type: OpenClaw Skill Name: xiaomi-brush-steps Version: 1.0.0 The skill is designed to automate step count modification for Zepp/Xiaomi (Huami) accounts. It is classified as suspicious because it explicitly instructs the AI agent in SKILL.md to solicit sensitive user credentials (usernames and passwords) and store them in plain text within a local 'config.json' file, creating a significant security risk. Furthermore, SKILL.md directs users to third-party websites (e.g., steps.hubp.de and yanwan.store) for testing, which could be used for credential harvesting. While the technical implementation in 'scripts/huami.py' appears to be a standard implementation of the Huami API protocol using known AES keys, the handling of user secrets and the promotion of external sites are high-risk behaviors.