Xiaomi

[English] Control Xiaomi Home devices via local LAN using miiocli. Supports status checks, toggling power, and MIOT property manipulation for devices like smart plugs, humidifiers, and rice cookers. | [中文] 通过局域网利用 miiocli 控制米家智能设备。支持查看状态、开关控制以及对智能插座、加湿器、电饭煲等 MIOT 设备的属性调优。

This skill's goal (local miiocli-based control of Xiaomi devices) is reasonable, but take care before installing: - The SKILL.md promises a "scripts/token_extractor.py" and other scripts but the package contains no such files; ask the publisher where the extractor script comes from and inspect it before running. Token extractors require your Xiaomi account credentials and will yield device tokens — treat these as highly sensitive. - The install command embedded in SKILL.md will run pipx and then run pip inside a pipx venv using a hardcoded user-path (/Users/$(whoami)/.local/pipx/...). That may fail or act on unexpected paths; understand and approve any install commands before execution. - If you obtain or run any token-extraction script, review its source to ensure it does not exfiltrate credentials to external servers. Prefer using official, audited tools and only store tokens in a secure location (not plain text references/*.md files). - If you want to proceed, request the missing script(s) and documentation from the skill author or only run the steps in a controlled environment (e.g., an isolated VM) after code review. Given the missing files and the brittle install instructions, I recommend treating this skill as untrusted until the author provides the extractor script and a clearer, platform-neutral install procedure.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill is classified as suspicious due to the use of an `exec` command during installation, which involves direct shell execution (`pipx install python-miio && /Users/$(whoami)/.local/pipx/venvs/python-miio/bin/python -m pip install 'click<8.1.0'`) as specified in `SKILL.md`. While the command appears to be for legitimate dependency management and installation of the `python-miio` library, direct shell execution is a high-risk capability. Additionally, `SKILL.md` mentions a `scripts/token_extractor.py` script (not provided for analysis) intended to fetch sensitive device tokens from Xiaomi Cloud, which, if malicious, could pose a significant risk, even though the skill itself does not execute it.